Remote code execution when trying to load custom region about holidays

[ppeble]

Thanks for reporting this! I completely see what you are saying.

I am in the middle of rethinking much of this codebase. In the meantime, what do we think of simply running a File.basename(prefix) for the target region? This way in the case of ../../../../../../../../../../../../tmp/profile_pic.jpg it would resolve to profile_pic.jpg, which would fail since it would not be a valid region in the 'holidays' directory. Thoughts?

[Intrepidd]

That's damage control, it's better of course but not optimal, you decide if that's enough for you for a quick fix :)

For the rethinking though, allowed custom regions should be added to an array or something to completely remove loading of code like this.

[ppeble]

It's been forever for this but I think I'm going to do this damage control while I perform a rewrite on another branch. I can't wait until the rewrite is complete before fixing it. 😞

[johnnyshields]

@ptrimble I think your proposed solution of File.basename is adequate.

[ppeble]

I know it's ridiculously, embarrassingly late but with the refactor I can now more easily perform region validation. I have added the fix to my branch, which I plan on merging to a release candidate branch (or something like that) in the near future with the goal of merging my current work into master.

Here is the commit in question: ppeble@af5d103

[ppeble]

This has been merged.