From 5e1ee38467d1e8a2abf7474c87e99afee43bb0b2 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Tue, 8 Sep 2026 18:57:10 +0100 Subject: [PATCH] Ignore invalid object IDs in various redirects --- app/controllers/site_controller.rb | 20 ++++++++++------- test/controllers/site_controller_test.rb | 28 ++++++++++++++++++++++++ 2 files changed, 40 insertions(+), 8 deletions(-) diff --git a/app/controllers/site_controller.rb b/app/controllers/site_controller.rb index a6d9b4ab1..d650dfe68 100644 --- a/app/controllers/site_controller.rb +++ b/app/controllers/site_controller.rb @@ -44,13 +44,13 @@ class SiteController < ApplicationController options = new_params.to_unsafe_h.to_options - path = if params.key? :node + path = if valid_id?(params[:node]) node_path(params[:node], options) - elsif params.key? :way + elsif valid_id?(params[:way]) way_path(params[:way], options) - elsif params.key? :relation + elsif valid_id?(params[:relation]) relation_path(params[:relation], options) - elsif params.key? :changeset + elsif valid_id?(params[:changeset]) changeset_path(params[:changeset], options) else root_url(options) @@ -145,13 +145,13 @@ class SiteController < ApplicationController private def redirect_browse_params - if params[:node] + if valid_id?(params[:node]) redirect_to node_path(params[:node]) - elsif params[:way] + elsif valid_id?(params[:way]) redirect_to way_path(params[:way]) - elsif params[:relation] + elsif valid_id?(params[:relation]) redirect_to relation_path(params[:relation]) - elsif params[:note] + elsif valid_id?(params[:note]) redirect_to note_path(params[:note]) elsif params[:query] redirect_to search_path(:query => params[:query]) @@ -171,4 +171,8 @@ class SiteController < ApplicationController redirect_to params.to_unsafe_h.merge(:only_path => true, :anchor => anchor.join("&")) if anchor.present? end + + def valid_id?(candidate) + candidate&.match?(/\A\d+\Z/) + end end diff --git a/test/controllers/site_controller_test.rb b/test/controllers/site_controller_test.rb index 8fc86fa9c..cccfde5b8 100644 --- a/test/controllers/site_controller_test.rb +++ b/test/controllers/site_controller_test.rb @@ -89,15 +89,31 @@ class SiteControllerTest < ActionDispatch::IntegrationTest get root_path(:node => 123) assert_redirected_to node_path(123) + get root_path(:node => "x") + assert_response :success + assert_template "index" + get root_path(:way => 123) assert_redirected_to way_path(123) + get root_path(:way => "x") + assert_response :success + assert_template "index" + get root_path(:relation => 123) assert_redirected_to relation_path(123) + get root_path(:relation => "x") + assert_response :success + assert_template "index" + get root_path(:note => 123) assert_redirected_to :controller => :notes, :action => :show, :id => 123 + get root_path(:note => "x") + assert_response :success + assert_template "index" + get root_path(:query => "test") assert_redirected_to search_path(:query => "test") @@ -131,14 +147,26 @@ class SiteControllerTest < ActionDispatch::IntegrationTest get permalink_path(:code => "wBz3--", :node => 1) assert_redirected_to node_path(1, :anchor => "map=3/4.8779296875/3.955078125") + get permalink_path(:code => "wBz3--", :node => "x") + assert_redirected_to :controller => :site, :action => :index, :anchor => "map=3/4.8779296875/3.955078125" + get permalink_path(:code => "wBz3--", :way => 2) assert_redirected_to way_path(2, :anchor => "map=3/4.8779296875/3.955078125") + get permalink_path(:code => "wBz3--", :way => "x") + assert_redirected_to :controller => :site, :action => :index, :anchor => "map=3/4.8779296875/3.955078125" + get permalink_path(:code => "wBz3--", :relation => 3) assert_redirected_to relation_path(3, :anchor => "map=3/4.8779296875/3.955078125") + get permalink_path(:code => "wBz3--", :relation => "x") + assert_redirected_to :controller => :site, :action => :index, :anchor => "map=3/4.8779296875/3.955078125" + get permalink_path(:code => "wBz3--", :changeset => 4) assert_redirected_to changeset_path(4, :anchor => "map=3/4.8779296875/3.955078125") + + get permalink_path(:code => "wBz3--", :changeset => "x") + assert_redirected_to :controller => :site, :action => :index, :anchor => "map=3/4.8779296875/3.955078125" end # Test the edit page redirects when you aren't logged in -- 2.47.3