From a219df24ca8e621e8936bb9fc8b75f8f7f1e15da Mon Sep 17 00:00:00 2001 From: Andy Allan Date: Wed, 1 Apr 2020 17:53:37 +0200 Subject: [PATCH] Ensure that urls are only valid if the entire string is a url This replaces our homegrown regexps (that didn't quite work) with ruby built-in regexps, and uses the termination anchor to ensure that the entire string, not just the first part, is validated. --- app/models/client_application.rb | 6 +++--- test/models/client_application_test.rb | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/app/models/client_application.rb b/app/models/client_application.rb index 67ff075f1..4e3dffb99 100644 --- a/app/models/client_application.rb +++ b/app/models/client_application.rb @@ -39,9 +39,9 @@ class ClientApplication < ApplicationRecord validates :key, :presence => true, :uniqueness => true validates :name, :url, :secret, :presence => true - validates :url, :format => %r{\Ahttp(s?)://(\w+:{0,1}\w*@)?(\S+)(:[0-9]+)?(/|/([\w#!:.?+=&%@!\-/]))?}i - validates :support_url, :allow_blank => true, :format => %r{\Ahttp(s?)://(\w+:{0,1}\w*@)?(\S+)(:[0-9]+)?(/|/([\w#!:.?+=&%@!\-/]))?}i - validates :callback_url, :allow_blank => true, :format => %r{\A[a-z][a-z0-9.+-]*://(\w+:{0,1}\w*@)?(\S+)(:[0-9]+)?(/|/([\w#!:.?+=&%@!\-/]))?}i + validates :url, :format => /\A#{URI::DEFAULT_PARSER.make_regexp(%w[http https])}\z/ + validates :support_url, :allow_blank => true, :format => /\A#{URI::DEFAULT_PARSER.make_regexp(%w[http https])}\z/ + validates :callback_url, :allow_blank => true, :format => /\A#{URI::DEFAULT_PARSER.make_regexp}\z/ before_validation :generate_keys, :on => :create diff --git a/test/models/client_application_test.rb b/test/models/client_application_test.rb index 8e5b21aff..c0b7b7977 100644 --- a/test/models/client_application_test.rb +++ b/test/models/client_application_test.rb @@ -3,7 +3,7 @@ require "test_helper" class ClientApplicationTest < ActiveSupport::TestCase def test_url_valid ok = ["http://example.com/test", "https://example.com/test"] - bad = ["", "ftp://example.com/test", "myapp://somewhere"] + bad = ["", "ftp://example.com/test", "myapp://somewhere", "http://example.com\nhttp://example.net"] ok.each do |url| app = build(:client_application) @@ -20,7 +20,7 @@ class ClientApplicationTest < ActiveSupport::TestCase def test_support_url_valid ok = ["", "http://example.com/test", "https://example.com/test"] - bad = ["ftp://example.com/test", "myapp://somewhere", "gibberish"] + bad = ["ftp://example.com/test", "myapp://somewhere", "gibberish", "http://example.com\nhttp://example.net"] ok.each do |url| app = build(:client_application) @@ -37,7 +37,7 @@ class ClientApplicationTest < ActiveSupport::TestCase def test_callback_url_valid ok = ["", "http://example.com/test", "https://example.com/test", "ftp://example.com/test", "myapp://somewhere"] - bad = ["gibberish"] + bad = ["gibberish", "http://example.com\nhttp://example.net"] ok.each do |url| app = build(:client_application) -- 2.45.2