Fix invalid byte sequence
This commit is contained in:
parent
8e75748aab
commit
53834c1874
3 changed files with 11 additions and 1 deletions
|
@ -0,0 +1,5 @@
|
||||||
|
---
|
||||||
|
title: Fix 500 error caused by invalid byte sequences in links
|
||||||
|
merge_request:
|
||||||
|
author:
|
||||||
|
type: security
|
|
@ -172,7 +172,7 @@ module Banzai
|
||||||
end
|
end
|
||||||
|
|
||||||
def cleaned_file_path(uri)
|
def cleaned_file_path(uri)
|
||||||
Addressable::URI.unescape(uri.path).delete("\0").chomp("/")
|
Addressable::URI.unescape(uri.path).scrub.delete("\0").chomp("/")
|
||||||
end
|
end
|
||||||
|
|
||||||
def relative_file_path(uri)
|
def relative_file_path(uri)
|
||||||
|
|
|
@ -119,6 +119,11 @@ describe Banzai::Filter::RelativeLinkFilter do
|
||||||
expect { filter(act) }.not_to raise_error
|
expect { filter(act) }.not_to raise_error
|
||||||
end
|
end
|
||||||
|
|
||||||
|
it 'does not raise an exception on URIs containing invalid utf-8 byte sequences' do
|
||||||
|
act = link("%FF")
|
||||||
|
expect { filter(act) }.not_to raise_error
|
||||||
|
end
|
||||||
|
|
||||||
it 'does not raise an exception with a garbled path' do
|
it 'does not raise an exception with a garbled path' do
|
||||||
act = link("open(/var/tmp/):%20/location%0Afrom:%20/test")
|
act = link("open(/var/tmp/):%20/location%0Afrom:%20/test")
|
||||||
expect { filter(act) }.not_to raise_error
|
expect { filter(act) }.not_to raise_error
|
||||||
|
|
Loading…
Reference in a new issue