thoughtbot/high_voltage — pull request #40 by shamanime (2012-08-14 19:12:36+00:00)
Title: Fix lfi exploit

Hello!

The way it currently works allows us to add whatever we want to the url and render in the browser any file from the server.

Take this example, from an app using the gem:
http://myapp.dev/pages/%2f%5c..%2f%5c..%2f%5c..%2f%5c..%2f%5c..%2f%5c..%2f%5c..%2fetc%2fpasswd

With those parameters, it's just a matter of adding or removing "%2f%5c.." until I get the passwd file content in the browser.

I think a lot of apps are vulnerable to that exploit.

I'm not sure about the best way to fix that, but what I did works.
I get the params[:id] and remove from it all unwanted characters, or anything that isn't a letter, number, _ or -.