new router patch fixes runaway vulnerability, thanks Jonathan

2012-11-27 11:29:36 -06:00
parent 25f16b5315
commit fabc3a5db1
3 changed files with 10 additions and 5 deletions
@@ -89,8 +89,8 @@
 #         domains = None,
 #         map_hyphen = False,
 #         acfe_match = r'\w+$',                 # legal app/ctlr/fcn/ext
-#         file_match = r'([-+=@$%\w]+[./]?)+$', # legal static subpath
-#         args_match = r'([\w@ -]+[=.]?)+$',    # legal arg in args
+#         file_match = r'([-+=@$%\w]|(?<=[-+=@$%\w])[./])*$',   # legal static subpath
+#         args_match = r'([\w@ -]|(?<=[\w@ -])[.=])*$',         # legal arg in args
 #     )
 #
 #  See rewrite.map_url_in() and rewrite.map_url_out() for implementation details.