CVE-2013-4413: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot slash) in the step.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2014-03-11T19:37Z
Repository: https://github.com/schneems/wicked
Language: Ruby
Files changed: CHANGELOG.md, VERSION, lib/wicked.rb, lib/wicked/controller/concerns/render_redirect.rb, test/integration/security_test.rb
Commit date: 2013-10-08 12:03:12 -0500
Commit message: [close #94] Security Update

Prevent specially crafted url strings from being used to access unintended files via an escaped slash character `%2e`
Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index b12d20b..0d7e430 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
+## 1.0.1 (8/08/2013)
+
+* Fix security issue #94
+
 ## 1.0.0 (8/03/2013)
 
 * Rails 4 compatible tested version released
 * Remove compatibility for Ruby 1.8.7 since it is EOL
 
diff --git a/VERSION b/VERSION
index 3eefcb9..7dea76e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.0.0
+1.0.1
diff --git a/lib/wicked.rb b/lib/wicked.rb
index 3438ec7..30934ef 100644
--- a/lib/wicked.rb
+++ b/lib/wicked.rb
@@ -1,5 +1,7 @@
+require 'erb'
+
 module Wicked
   FINISH_STEP = "wicked_finish"
   FIRST_STEP  = "wicked_first"
   LAST_STEP   = "wicked_last"
 
diff --git a/lib/wicked/controller/concerns/render_redirect.rb b/lib/wicked/controller/concerns/render_redirect.rb
index f02534a..254ce5e 100644
--- a/lib/wicked/controller/concerns/render_redirect.rb
+++ b/lib/wicked/controller/concerns/render_redirect.rb
@@ -24,11 +24,11 @@ module Wicked::Controller::Concerns::RenderRedirect
 
   def render_step(the_step, options = {})
     if the_step.nil? || the_step.to_s == Wicked::FINISH_STEP
       redirect_to_finish_wizard options
     else
-      render the_step, options
+      render ERB::Util.url_encode(the_step), options
     end
   end
 
   def redirect_to_next(next_step, options = {})
     if next_step.nil?
diff --git a/test/integration/security_test.rb b/test/integration/security_test.rb
new file mode 100644
index 0000000..c144a2a
--- /dev/null
+++ b/test/integration/security_test.rb
@@ -0,0 +1,23 @@
+require 'test_helper'
+
+class SecurityTest < ActiveSupport::IntegrationCase
+
+  test 'does not show database.yml' do
+    step = "%2E%2F%2E%2E%2F%2E%2E%2Fconfig%2Fdatabase%2Eyml"
+    assert_raise ActionView::MissingTemplate do
+      visit(bar_path(step))
+    end
+    refute has_content?('sqlite3')
+  end
+
+  # only works on *nix systems
+  test 'does not show arbitrary system file' do
+    root = '%2E%2F%2E' * 100 # root of system
+    step = root + '%2Fusr%2Fshare%2Fdict%2Fwords'
+
+    assert_raise ActionView::MissingTemplate do
+      visit(bar_path(step))
+    end
+    refute has_content?('aardvark')
+  end
+end

Vulnerable code: 1.0.0
      render the_step, options
Fixed code: ## 1.0.1 (8/08/2013)

* Fix security issue #94

1.0.1
require 'erb'

      render ERB::Util.url_encode(the_step), options
require 'test_helper'

class SecurityTest < ActiveSupport::IntegrationCase

  test 'does not show database.yml' do
    step = "%2E%2F%2E%2E%2F%2E%2E%2Fconfig%2Fdatabase%2Eyml"
    assert_raise ActionView::MissingTemplate do
      visit(bar_path(step))
    end
    refute has_content?('sqlite3')
  end

  # only works on *nix systems
  test 'does not show arbitrary system file' do
    root = '%2E%2F%2E' * 100 # root of system
    step = root + '%2Fusr%2Fshare%2Fdict%2Fwords'

    assert_raise ActionView::MissingTemplate do
      visit(bar_path(step))
    end
    refute has_content?('aardvark')
  end
end