---
title: Fix 500 error caused by invalid byte sequences in links
merge_request:
author:
type: security
......@@ -103,7 +103,7 @@ module Banzai
end
def relative_file_path(uri)
path = Addressable::URI.unescape(uri.path).delete("\0")
path = Addressable::URI.unescape(uri.path).scrub.delete("\0")
request_path = Addressable::URI.unescape(context[:requested_path])
nested_path = build_relative_path(path, request_path)
file_exists?(nested_path) ? nested_path : path
......
......
......@@ -87,6 +87,11 @@ describe Banzai::Filter::RelativeLinkFilter do
expect { filter(act) }.not_to raise_error
end
it 'does not raise an exception on URIs containing invalid utf-8 byte sequences' do
act = link("%FF")
expect { filter(act) }.not_to raise_error
end
it 'does not raise an exception with a garbled path' do
act = link("open(/var/tmp/):%20/location%0Afrom:%20/test")
expect { filter(act) }.not_to raise_error
......
......