gotoyuzo	2008-05-21 01:35:25 +0900 (Wed, 21 May 2008)

  New Revision: 16495

  Added files:
    branches/ruby_1_8_5/test/webrick/.htaccess
    branches/ruby_1_8_5/test/webrick/webrick_long_filename.cgi
    branches/ruby_1_8_6/test/webrick/.htaccess
    branches/ruby_1_8_6/test/webrick/webrick_long_filename.cgi
  Modified files:
    branches/ruby_1_8_5/ChangeLog
    branches/ruby_1_8_5/lib/webrick/httpservlet/abstract.rb
    branches/ruby_1_8_5/lib/webrick/httpservlet/cgi_runner.rb
    branches/ruby_1_8_5/lib/webrick/httpservlet/filehandler.rb
    branches/ruby_1_8_5/test/webrick/test_cgi.rb
    branches/ruby_1_8_5/test/webrick/test_filehandler.rb
    branches/ruby_1_8_5/test/webrick/utils.rb
    branches/ruby_1_8_5/version.h
    branches/ruby_1_8_6/ChangeLog
    branches/ruby_1_8_6/lib/webrick/httpservlet/abstract.rb
    branches/ruby_1_8_6/lib/webrick/httpservlet/cgi_runner.rb
    branches/ruby_1_8_6/lib/webrick/httpservlet/filehandler.rb
    branches/ruby_1_8_6/test/webrick/test_cgi.rb
    branches/ruby_1_8_6/test/webrick/test_filehandler.rb
    branches/ruby_1_8_6/test/webrick/utils.rb
    branches/ruby_1_8_6/version.h

  Log:
    * lib/webrick/httpservlet/filehandler.rb: should normalize path
      name in path_info to prevent script disclosure vulnerability on
      DOSISH filesystems. (fix: CVE-2008-1891)
      Note: NTFS/FAT filesystem should not be published by the platforms
      other than Windows. Pathname interpretation (including short
      filename) is less than perfect.
    
    * lib/webrick/httpservlet/abstract.rb
      (WEBrick::HTTPServlet::AbstracServlet#redirect_to_directory_uri):
      should escape the value of Location: header.
    
    * lib/webrick/httpservlet/cgi_runner.rb: accept interpreter
      command line arguments.


  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/test/webrick/utils.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/ChangeLog?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/lib/webrick/httpservlet/cgi_runner.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/version.h?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/lib/webrick/httpservlet/cgi_runner.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/test/webrick/.htaccess?revision=16495&view=markup
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/test/webrick/test_filehandler.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/test/webrick/webrick_long_filename.cgi?revision=16495&view=markup
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/test/webrick/webrick_long_filename.cgi?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/test/webrick/test_cgi.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/test/webrick/test_filehandler.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/test/webrick/utils.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/test/webrick/test_cgi.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/version.h?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/lib/webrick/httpservlet/filehandler.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/test/webrick/.htaccess?revision=16495&view=markup
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/lib/webrick/httpservlet/abstract.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/lib/webrick/httpservlet/abstract.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/ChangeLog?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/lib/webrick/httpservlet/filehandler.rb?r1=16495&r2=16494&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/test/webrick/webrick_long_filename.cgi?revision=16495&view=markup
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/test/webrick/webrick_long_filename.cgi?r1=16495&r2=16494&diff_format=u