fix: Path traversal at SwaggerController (#6205)

2023-01-12 23:44:21 +05:30
parent 9bbadc2388
commit 9e4a5d028c
1 changed files with 2 additions and 2 deletions
@@ -11,8 +11,8 @@ class SwaggerController < ApplicationController

  def derived_path
    params[:path] ||= 'index.html'
-    path = params[:path]
-    path << ".#{params[:format]}" unless path.ends_with?(params[:format].to_s)
+    path = Rack::Utils.clean_path_info(params[:path])
+    path << ".#{Rack::Utils.clean_path_info(params[:format])}" unless path.ends_with?(params[:format].to_s)
    path
  end
 end