From c35475ab5f7c4dafa121ebd544206815b583fb81 Mon Sep 17 00:00:00 2001 From: Andy Allan Date: Wed, 5 Aug 2026 14:12:48 +0100 Subject: [PATCH] Select contributor terms from a list of the available jurisdictions Rather than probing the filesystem with an interpolated path and falling back when it doesn't exist, check the country code against the set of files in config/legales, so that only known-good values are ever joined onto a path. This also covers codes returned by OSM.ip_to_country, which the controller's parameter validation doesn't apply to. --- lib/osm.rb | 9 ++++++--- test/lib/osm_test.rb | 17 +++++++++++++++++ 2 files changed, 23 insertions(+), 3 deletions(-) diff --git a/lib/osm.rb b/lib/osm.rb index e707bbecb..ea1fe7901 100644 --- a/lib/osm.rb +++ b/lib/osm.rb @@ -537,11 +537,14 @@ module OSM "AND #{prefix}longitude BETWEEN #{bbox.min_lon} AND #{bbox.max_lon}" end + # The jurisdictions for which we have contributor terms + LEGALES = Rails.root.glob("config/legales/*.yml").map { |path| path.basename(".yml").to_s }.freeze + # Return the terms and conditions text for a given country def self.legal_text_for_country(country_code) - file_name = Rails.root.join("config", "legales", "#{country_code}.yml") - file_name = Rails.root.join("config", "legales", "#{Settings.default_legale}.yml") unless File.exist? file_name - YAML.load_file(file_name).transform_values!(&:html_safe) + country_code = Settings.default_legale unless LEGALES.include?(country_code) + + YAML.load_file(Rails.root.join("config/legales/#{country_code}.yml")).transform_values(&:html_safe) end # Return the HTTP client to use diff --git a/test/lib/osm_test.rb b/test/lib/osm_test.rb index 1389fbb02..cd83840a3 100644 --- a/test/lib/osm_test.rb +++ b/test/lib/osm_test.rb @@ -14,4 +14,21 @@ class OsmTest < ActiveSupport::TestCase assert_in_delta(50, proj.x(0), 0.01) assert_in_delta(100, proj.y(0), 0.01) end + + def test_legal_text_for_country + OSM::LEGALES.each do |legale| + text = OSM.legal_text_for_country(legale) + + assert_predicate text["intro"], :html_safe? + end + end + + def test_legal_text_for_unknown_country + default_text = OSM.legal_text_for_country(Settings.default_legale) + + ["ZZ", "..", "../../config/settings", "/etc/passwd", "GB\n../../config/settings", nil] + .each do |legale| + assert_equal default_text, OSM.legal_text_for_country(legale) + end + end end -- 2.47.3