diff --git a/rack-protection/lib/rack/protection/base.rb b/rack-protection/lib/rack/protection/base.rb index 5a102f67..fb097ab8 100755 --- a/rack-protection/lib/rack/protection/base.rb +++ b/rack-protection/lib/rack/protection/base.rb @@ -10,7 +10,8 @@ module Rack :reaction => :default_reaction, :logging => true, :message => 'Forbidden', :encryptor => Digest::SHA1, :session_key => 'rack.session', :status => 403, - :allow_empty_referrer => true + :allow_empty_referrer => true, + :html_types => %w[text/html application/xhtml] } attr_reader :app, :options @@ -98,16 +99,8 @@ module Rack alias default_reaction deny def html?(headers) - if type = headers.detect { |k,v| k.downcase == 'content-type' } - case type.last[/^\w+\/\w+/] - when 'text/html', 'application/xhtml' - true - else - false - end - else - false - end + return false unless header = headers.detect { |k,v| k.downcase == 'content-type' } + options[:html_types].include? header.last[/^\w+\/\w+/] end end end diff --git a/rack-protection/spec/protection_spec.rb b/rack-protection/spec/protection_spec.rb index d835f557..4e682fc9 100755 --- a/rack-protection/spec/protection_spec.rb +++ b/rack-protection/spec/protection_spec.rb @@ -20,12 +20,12 @@ describe Rack::Protection do describe "#html?" do context "given an appropriate content-type header" do - subject { Rack::Protection::Base.new(nil).html?({'content-type' => "text/html"}) } + subject { Rack::Protection::Base.new(nil).html? 'content-type' => "text/html" } it { should be_true } end context "given an inappropriate content-type header" do - subject { Rack::Protection::Base.new(nil).html?({'content-type' => "image/gif"}) } + subject { Rack::Protection::Base.new(nil).html? 'content-type' => "image/gif" } it { should be_false } end