diff --git a/apps/dashboard/app/models/allowlist_policy.rb b/apps/dashboard/app/models/allowlist_policy.rb index 0cc751d130..eb6f668c18 100644 --- a/apps/dashboard/app/models/allowlist_policy.rb +++ b/apps/dashboard/app/models/allowlist_policy.rb @@ -82,9 +82,7 @@ def child?(parent, child) # Expand both paths to evaluate any potential ".." components to be able to compare them as strings. p = parent.expand_path.to_s c = child.expand_path.to_s - # Child path shorter than parent => not a child. - return false if c.size < p.size - # Child path is same as parent path, or has additional components after parent path (has "/" after parent path). - c[0...p.size] == p && (c.size == p.size || c[p.size] == "/") + # Child path if it is same as parent path, or has additional components after "/". + c.start_with?(p) && (c.size == p.size || c[p.size] == "/") end end