refs #CNVS-1125
this prevents any funky user input to the
xml_schema action in the ContentExport controller
from pulling up anything other than the
items in the target xsd directory.
TEST PLAN:
tough to test from the outside
because the existing pathing prevents
very much monkeying with the file path,
so most attack attempts would be prevented
simply by naively interpreting the path
as nonexistent for our routing config. If you
find any way to get any other file in
the system except the ones in that
directory via the "/xsd/#{something}.xsd"
url path then you win and I have more to fix.
Change-Id: Iddb22c9bbd5778d67c3737c5425126419297a5d3
Reviewed-on: https://gerrit.instructure.com/15774
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Cody Cutrer