go_to_param 0.3.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8ff657dfce2b1757a637ff58b8614803f96415b4
-  data.tar.gz: 446aaba35e959473a3ec0df17e3ada34ee91a831
+  metadata.gz: 6fa16c7fe969b722bbc7f884c7b2f1b24df75bb7
+  data.tar.gz: 0e7c3acd3d434566ffeb201eb006a43765dad107
 SHA512:
-  metadata.gz: 0d882496e336ab925a45599ad950c2c2541c8b6a3b798eea41b1cf75aa7982747b0c9a3481c4c9e17090deb3ed84d3610b5f74054497ac79b3b422ac95ee7e9e
-  data.tar.gz: 405bed370bc54b4a81c0ddecc8968ad31ea3e7d0de39207433ec77b65651fd296026299a474196a9410db868f97862c79796f1a9f465c3cb13a53ddb055c3461
+  metadata.gz: bfccf03b703ea760d1b8ae8a81cd238052248b18f70e3044d76856577edbdc40f304602178d4716774427fde0579d0a19062e7bf1c401509fa401d85978e1ee0
+  data.tar.gz: 45575857ba7c020275d9f1384264b13a4c4892afaefc30864babf7b206197c2f6362b303bf872b8e3b129036d91a0edb546b8244d0a0c45114670371c5c1d26c

data/README.md

@@ -114,7 +114,13 @@ class SessionsController < ActionController::Base
 end
 ```
 
-Returns nil if the parameter value is not a relative path, to counter phishing attempts like `/login?go_to=http://evil.com/success_now_give_me_your_cc_details`.
+Returns `nil` if the parameter value is not a relative path, to counter phishing attempts like `/login?go_to=http://evil.com/success_now_give_me_your_cc_details`.
+
+If you need to allow some external URLs, that can be configured. You could do this in e.g. a `config/initializers/go_to.rb` file:
+
+``` ruby
+GoToParam.allow_redirect_prefix("myapp://")
+```
 
 ### go_to_path_or
 
@@ -139,6 +145,7 @@ Or install it yourself as:
 
     $ gem install go_to_param
 
+
 ## License
 
 Copyright (c) 2013 Henrik Nyh

data/lib/go_to_param.rb

@@ -2,6 +2,20 @@ require "cgi"
 require "go_to_param/version"
 
 module GoToParam
+  def self.allow_redirect_prefix(prefix)
+    allowed_redirect_prefixes << prefix
+  end
+
+  def self.allowed_redirect_prefixes
+    reset_allowed_redirect_prefixes unless @allowed_redirect_prefixes
+    @allowed_redirect_prefixes
+  end
+
+  # Mostly for tests…
+  def self.reset_allowed_redirect_prefixes
+    @allowed_redirect_prefixes = [ "/" ]
+  end
+
   def self.included(klass)
     klass.helper_method :hidden_go_to_tag, :hidden_go_to_here_tag,
       :go_to_params, :go_to_here_params,
@@ -31,8 +45,10 @@ module GoToParam
   end
 
   def go_to_path
+    return nil if go_to_param_value.nil?
+
     # Avoid phishing redirects.
-    if go_to_param_value.to_s.start_with?("/")
+    if matches_allowed_redirect_prefixes?
       go_to_param_value
     else
       nil
@@ -45,6 +61,10 @@ module GoToParam
 
   private
 
+  def matches_allowed_redirect_prefixes?
+    GoToParam.allowed_redirect_prefixes.any? { |prefix| go_to_param_value.start_with?(prefix) }
+  end
+
   def go_to_here_path(additional_query_params = {})
     if request.get?
       _go_to_add_query_string_from_hash(_go_to_fullpath, additional_query_params)

data/lib/go_to_param/version.rb

@@ -1,3 +1,3 @@
 module GoToParam
-  VERSION = "0.3.0"
+  VERSION = "1.0.0"
 end

data/spec/go_to_param_spec.rb

@@ -15,6 +15,8 @@ class FakeController
 end
 
 describe GoToParam do
+  after { GoToParam.reset_allowed_redirect_prefixes }
+
   let(:controller) { FakeController.new }
 
   describe "#hidden_go_to_tag" do
@@ -101,7 +103,7 @@ describe GoToParam do
 
     it "makes sure the go_to path is valid UTF-8" do
       weird_path = "\xE0\x80\x80weird\330stuff".force_encoding("ASCII-8BIT")
-      replacement = "\uFFFD"  # The Unicode 'Replacement Character'
+      replacement = "\uFFFD"  # The Unicode "Replacement Character".
 
       controller.request = double(get?: true, fullpath: weird_path)
 
@@ -126,6 +128,13 @@ describe GoToParam do
       controller.params = { go_to: "http://evil.com", id: "1" }
       expect(controller.go_to_path).to be_nil
     end
+
+    it "respects custom allowed redirect prefixes" do
+      GoToParam.allow_redirect_prefix("myapp://")
+
+      controller.params = { go_to: "myapp://", id: "1" }
+      expect(controller.go_to_path).to eq("myapp://")
+    end
   end
 
   describe "#go_to_path_or" do
@@ -138,7 +147,12 @@ describe GoToParam do
       expect(controller.go_to_path_or("/default")).to eq("/example")
     end
 
-    it "is the passed-in value if the parameter value is not a relative path" do
+    it "falls back if the go_to param is blank" do
+      controller.params = { go_to: "", id: "1" }
+      expect(controller.go_to_path_or("/default")).to eq("/default")
+    end
+
+    it "falls back if the go_to param is not allowed" do
       controller.params = { go_to: "http://evil.com", id: "1" }
       expect(controller.go_to_path_or("/default")).to eq("/default")
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: go_to_param
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Henrik N
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-26 00:00:00.000000000 Z
+date: 2015-12-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler