Fix Improper Assets Management in Camping

Improper Assets Management in the Camping micro-framework often leads to Information Disclosure and Directory Traversal. When developers map routes directly to filesystem reads without strict path normalization or scope limiting, they inadvertently expose the entire server environment, including sensitive configuration files, source code, and environment variables.

The Vulnerable Pattern

module App
  module Controllers
    class Static < R '/static/(.+)'
      def get(path)
        # CRITICAL: Directly reading from the filesystem using user-supplied path.
        # An attacker can request /static/../../config.ru or /static/%2e%2e/%2e%2e/.env
        File.read(path)
      end
    end
  end
end

The Secure Implementation

The vulnerability stems from trusting the route's capture group as a literal file path. In the vulnerable snippet, 'File.read(path)' executes in the context of the application's working directory, allowing 'path' to traverse into parent directories. The secure implementation employs a 'chroot-like' validation strategy: it uses File.expand_path to resolve all relative segments and then checks if the resulting absolute path remains prefixed by the intended public directory. This effectively prevents attackers from escaping the asset sandbox.

module App
  module Controllers
    class Static < R '/static/(.+)'
      # Define a hardened root for assets
      ASSET_ROOT = File.expand_path('./public')
  def get(path)
    # 1. Join and expand the path to resolve '../'
    target_path = File.expand_path(File.join(ASSET_ROOT, path))

    # 2. Verify the expanded path is still within the ASSET_ROOT
    if target_path.start_with?(ASSET_ROOT) && File.file?(target_path)
      @headers['Content-Type'] = 'text/plain'
      File.read(target_path)
    else
      r(404, "Not Found")
    end
  end
end
end
end