codeninjasllc/discourse
1
0
Fork 0
mirror of https://github.com/codeninjasllc/discourse.git synced 2024-11-27 09:36:19 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

FIX: Run the regular expression against query parameters

Browse source
This commit is contained in:
Robin Ward 2016-08-26 12:47:21 -04:00
parent 39de27a4b2
commit 20241a01e9
2 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
app/models/embeddable_host.rb
View file

@ -24,9 +24,13 @@ class EmbeddableHost < ActiveRecord::Base
uri = URI(url) rescue nil
return false unless uri.present?
path = uri.path
path << "?" << uri.query if uri.query.present?
host = record_for_url(uri)
return host.present? &&
(host.path_whitelist.blank? || !Regexp.new(host.path_whitelist).match(uri.path).nil?)
(host.path_whitelist.blank? || !Regexp.new(host.path_whitelist).match(path).nil?)
end
private

8
spec/models/embeddable_host_spec.rb
View file

@ -66,13 +66,17 @@ describe EmbeddableHost do
end
describe "path_whitelist" do
let!(:host) { Fabricate(:embeddable_host, path_whitelist: '^/fp/\d{4}/\d{2}/\d{2}/.*$') }
it "matches the path" do
Fabricate(:embeddable_host, path_whitelist: '^/fp/\d{4}/\d{2}/\d{2}/.*$')
expect(EmbeddableHost.url_allowed?('http://eviltrout.com')).to eq(false)
expect(EmbeddableHost.url_allowed?('http://eviltrout.com/fp/2016/08/25/test-page')).to eq(true)
end
it "respects query parameters" do
Fabricate(:embeddable_host, path_whitelist: '^/fp$')
expect(EmbeddableHost.url_allowed?('http://eviltrout.com/fp?test=1')).to eq(false)
expect(EmbeddableHost.url_allowed?('http://eviltrout.com/fp')).to eq(true)
end
end
end