ActionController::Base.helpers.sanitize ignores case in protocol
[#6044 state:committed] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>
This commit is contained in:
parent
573fd39e22
commit
e5b84fd723
|
@ -170,7 +170,7 @@ module HTML
|
||||||
|
|
||||||
def contains_bad_protocols?(attr_name, value)
|
def contains_bad_protocols?(attr_name, value)
|
||||||
uri_attributes.include?(attr_name) &&
|
uri_attributes.include?(attr_name) &&
|
||||||
(value =~ /(^[^\/:]*):|(�*58)|(p)|(%|%)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first))
|
(value =~ /(^[^\/:]*):|(�*58)|(p)|(%|%)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first.downcase))
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -1 +0,0 @@
|
||||||
../../symlink_parent
|
|
|
@ -131,6 +131,13 @@ class SanitizerTest < ActionController::TestCase
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def test_should_accept_good_protocols_ignoring_case
|
||||||
|
sanitizer = HTML::WhiteListSanitizer.new
|
||||||
|
HTML::WhiteListSanitizer.allowed_protocols.each do |proto|
|
||||||
|
assert !sanitizer.send(:contains_bad_protocols?, 'src', "#{proto.capitalize}://good")
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
def test_should_accept_good_protocols
|
def test_should_accept_good_protocols
|
||||||
sanitizer = HTML::WhiteListSanitizer.new
|
sanitizer = HTML::WhiteListSanitizer.new
|
||||||
HTML::WhiteListSanitizer.allowed_protocols.each do |proto|
|
HTML::WhiteListSanitizer.allowed_protocols.each do |proto|
|
||||||
|
|
Loading…
Reference in New Issue