kotovalexarian-likes-github
/
rails--rails
mirror of https://github.com/rails/rails.git
1
0
Fork 0
Code Releases Activity

ActionController::Base.helpers.sanitize ignores case in protocol 

[#6044 state:committed]

Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>
This commit is contained in:
Timothy N. Tsvetkov 2010-11-24 00:17:05 +03:00 committed by Santiago Pastorino
parent 573fd39e22
commit e5b84fd723
3 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb vendored
View File

@ -170,7 +170,7 @@ module HTML
def contains_bad_protocols?(attr_name, value)
uri_attributes.include?(attr_name) &&
(value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(%|&#37;)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first))
(value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(%|&#37;)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first.downcase))
end
end
end

1
actionpack/test/fixtures/layout_tests/layouts/symlinked vendored
View File

@ -1 +0,0 @@
../../symlink_parent

7
actionpack/test/template/html-scanner/sanitizer_test.rb
View File

@ -131,6 +131,13 @@ class SanitizerTest < ActionController::TestCase
end
end
def test_should_accept_good_protocols_ignoring_case
sanitizer = HTML::WhiteListSanitizer.new
HTML::WhiteListSanitizer.allowed_protocols.each do |proto|
assert !sanitizer.send(:contains_bad_protocols?, 'src', "#{proto.capitalize}://good")
end
end
def test_should_accept_good_protocols
sanitizer = HTML::WhiteListSanitizer.new
HTML::WhiteListSanitizer.allowed_protocols.each do |proto|