Avoid converting conditional restriction tags into emails

Fixes #3884

diff --git a/app/helpers/browse_tags_helper.rb b/app/helpers/browse_tags_helper.rb
index 18598e88d69c5cd9bd07989f85cb531331fbf06e..f95003aae6ad791bf7a9c9846aefbcf6fd291c0f 100644 (file)
--- a/app/helpers/browse_tags_helper.rb
+++ b/app/helpers/browse_tags_helper.rb
@@ -125,7 +125,10 @@ module BrowseTagsHelper
     nil
   end
 
-  def email_link(_key, value)
+  def email_link(key, value)
+    # Avoid converting conditional tags into emails, since EMAIL_REGEXP is quite permissive
+    return nil unless %w[email contact:email].include? key
+
     # Does the value look like an email? eg "someone@domain.tld"
 
     #  Uses Ruby built-in regexp to validate email.

diff --git a/test/helpers/browse_tags_helper_test.rb b/test/helpers/browse_tags_helper_test.rb
index a0e2e8fabb15efd89ba87d5d051fafcea43809cb..f9f977c4986026206e433f480002fb74c34d5312 100644 (file)
--- a/test/helpers/browse_tags_helper_test.rb
+++ b/test/helpers/browse_tags_helper_test.rb
@@ -50,7 +50,7 @@ class BrowseTagsHelperTest < ActionView::TestCase
     html = format_value("colour", "#f00")
     assert_dom_equal %(<span class="colour-preview-box" data-colour="#f00" title="Colour #f00 preview"></span>#f00), html
 
-    html = format_value("contact", "foo@example.com")
+    html = format_value("email", "foo@example.com")
     assert_dom_equal "<a title=\"Email foo@example.com\" href=\"mailto:foo@example.com\">foo@example.com</a>", html
 
     html = format_value("source", "https://example.com")
@@ -269,6 +269,12 @@ class BrowseTagsHelperTest < ActionView::TestCase
     # Strips whitespace at ends
     email = email_link("email", " test@email.com ")
     assert_equal "test@email.com", email
+
+    email = email_link("contact:email", "example@example.com")
+    assert_equal "example@example.com", email
+
+    email = email_link("maxweight:conditional", "none@agricultural")
+    assert_nil email
   end
 
   def test_telephone_links