From c39f3a485bb2457af9d09555380c30957966b5e8 Mon Sep 17 00:00:00 2001 From: Andy Allan Date: Wed, 5 Aug 2026 14:12:40 +0100 Subject: [PATCH] Anchor legale parameter validation to the whole string Ruby's ^ and $ match at line boundaries, and rails_param tests the format with a bare =~, so a value such as "../../config/settings\nGB" satisfied /^[A-Z]+$/. --- app/controllers/accounts/terms_controller.rb | 2 +- test/controllers/accounts/terms_controller_test.rb | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/app/controllers/accounts/terms_controller.rb b/app/controllers/accounts/terms_controller.rb index 0f1c25627..957ca8ab1 100644 --- a/app/controllers/accounts/terms_controller.rb +++ b/app/controllers/accounts/terms_controller.rb @@ -13,7 +13,7 @@ module Accounts authorize_resource :class => :account_terms def show - param! :legale, String, :format => /^[A-Z]+$/ + param! :legale, String, :format => /\A[A-Z]+\z/ @legale = params[:legale] || OSM.ip_to_country(request.remote_ip) || Settings.default_legale @text = OSM.legal_text_for_country(@legale) diff --git a/test/controllers/accounts/terms_controller_test.rb b/test/controllers/accounts/terms_controller_test.rb index b5e7f1f1b..8b53be8e8 100644 --- a/test/controllers/accounts/terms_controller_test.rb +++ b/test/controllers/accounts/terms_controller_test.rb @@ -67,6 +67,15 @@ module Accounts assert_redirected_to :controller => "/errors", :action => :bad_request end + def test_show_with_multiline_legale + user = create(:user, :terms_seen => true, :terms_agreed => Date.yesterday) + session_for(user) + + get account_terms_path(:legale => "../../config/settings\nGB") + assert_response :redirect + assert_redirected_to :controller => "/errors", :action => :bad_request + end + def test_update_decline_by_not_checking_the_boxes freeze_time do user = create(:user, :terms_seen => false, :terms_agreed => nil, :tou_agreed => nil) -- 2.47.3