GHSA-h2jq-g4cq-5ppq

## Summary

`Rack::Static` determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as `"/css"`, it matches any request path that begins with that string, including unrelated paths such as `"/css-config.env"` or `"/css-backup.sql"`.

As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure.

## Details

`Rack::Static#route_file` performs static-route matching using logic equivalent to:

```ruby @urls.any? { |url| path.index(url) == 0 } ```

This checks only whether the request path starts with the configured prefix string. It does not require a path segment boundary after the prefix.

For example, with:

```ruby use Rack::Static, urls: ["/css", "/js"], root: "public" ```

the following path is matched as intended:

```text /css/style.css ```

but these paths are also matched:

```text /css-config.env /css-backup.sql /csssecrets.yml ```

If such files exist under the configured static root, Rack forwards the request to the file server and serves them as static content.

This means a configuration intended to expose only directory trees such as `/css/...` and `/js/...` may also expose sibling files whose names begin with those same strings.

## Impact

An attacker can request files under the configured static root whose names share a configured URL prefix and obtain their contents.

In affected deployments, this may expose configuration files, secrets, backups, environment files, or other unintended static content located under the same root directory.

## Mitigation

* Update to a patched version of Rack that enforces a path boundary when matching configured static URL prefixes. * Match only paths that are either exactly equal to the configured prefix or begin with `prefix + "/"`. * Avoid placing sensitive files under the `Rack::Static` root directory. * Prefer static URL mappings that cannot overlap with sensitive filenames.