Merge branch 'fix-directory-traversal-0.3' into 0.3

Author: philr

lib/tzinfo/timezone.rb

@@ -101,7 +101,7 @@ def self.default_dst
     def self.get(identifier)
       instance = @@loaded_zones[identifier]
       unless instance  
-        raise InvalidTimezoneIdentifier, 'Invalid identifier' if identifier !~ /^[A-Za-z0-9\+\-_]+(\/[A-Za-z0-9\+\-_]+)*$/
+        raise InvalidTimezoneIdentifier, 'Invalid identifier' if identifier !~ /\A[A-Za-z0-9+\-_]+(\/[A-Za-z0-9+\-_]+)*\z/
         identifier = identifier.gsub(/-/, '__m__').gsub(/\+/, '__p__')
         begin
           # Use a temporary variable to avoid an rdoc warning

test/in_load_path/payload.rb

@@ -0,0 +1 @@
+raise 'This should never be executed'

test/tc_timezone.rb

@@ -1,4 +1,5 @@
 $:.unshift File.join(File.dirname(__FILE__), "..", "lib")
+$:.unshift File.join(File.dirname(__FILE__), "in_load_path")
 require 'test/unit'
 require File.join(File.dirname(__FILE__), 'test_utils')
 require 'tzinfo'
@@ -97,7 +98,11 @@ def test_get_not_exist
   end
 
   def test_get_invalid
-    assert_raises(InvalidTimezoneIdentifier) { Timezone.get('../Definitions/UTC') }
+    assert_raises(InvalidTimezoneIdentifier) { Timezone.get('../definitions/UTC') }
+  end
+
+  def test_get_directory_traversal
+    assert_raises(InvalidTimezoneIdentifier) { Timezone.get("foo\n/../../../payload") }
   end
 
   def test_get_nil