Skip to content

Commit 043a865

Browse files
authored
Update Ruby-tempfile-mktmpdir-PT.md
1 parent 763f060 commit 043a865

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

Ruby-tempfile-mktmpdir-PT.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ While playing around Ruby we noticed that Ruby's Tempfile/mktmpdir were allowing
66

77
### CVE-2018-6914 Patch analysis
88

9-
A similar issue was previously reported by @oooooo_q for Linux, where `/` could be used which made path traversal possible on both Linux and Windows. We looked at the patch of this bug, which was relatively straight forward, delete `/` (File::SEPARATOR) and `\` (File::ALT_SEPARATOR, set on windows only) from the input before creating the file.
9+
A similar issue was previously reported by [@ooooooo_q](https://twitter.com/ooooooo_q) for Linux, where `/` could be used which made path traversal possible on both Linux and Windows. We looked at the patch of this bug, which was relatively straight forward, delete `/` (File::SEPARATOR) and `\` (File::ALT_SEPARATOR, set on windows only) from the input before creating the file.
1010

1111
```patch
1212
--- lib/tmpdir.rb

0 commit comments

Comments
 (0)