safe_redirect 0.1.5 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5a6d01c7330bafc677a98f499e04b7db0a6c27cf
-  data.tar.gz: 1672f119857023640eda0223d20e72a214de0129
+  metadata.gz: 83594e7e226d3e60888b702e5b78913e5608f048
+  data.tar.gz: b28b74779ef487115be6eeb9b64f4aae8e1855cf
 SHA512:
-  metadata.gz: 8b9cb5dc6823258bbe67023e1788fe357328e51bd9511345edea8048505ea269641dca477cc9df62fadd038d03065e5676d2d2b1e2365689451b2eaa718b761f
-  data.tar.gz: df89615fd2dbef7f302024a2ae396e70a6329378e6d38e8242c62d18cc9aa2824f768c740fcaec5f7c79f31fcc4e02b99b347f8c72d575a89895f6e06321fb46
+  metadata.gz: ffe4d06d9859fccd5cfd52e84e04bbb03351b50f77a202293c187601395c58b37e5cd360be776bc7ff360562051eabf6930f0440729a91e0a348c1b441b4ba0d
+  data.tar.gz: 375f867f4049e2ae31777a318e58d70da3d5a17a25129dc9821a073d6cfc9c30570572acab67bc5e1fbe80761b2569ae1f17af0a1db02458ed0e7916055c433a

data/lib/safe_redirect/safe_redirect.rb

@@ -29,7 +29,7 @@ module SafeRedirect
     stripped_path = path.strip
     unless safe_domain?(stripped_path)
       stripped_path.gsub!(/https?:\/\/[a-z0-9\-\.:@]*/i, '')
-      stripped_path.gsub!(/^(data:|javascript:|\.|\/\/|@)+[a-z0-9\-\.:@]*/i, '')
+      stripped_path.gsub!(/^((https?:|data:|javascript:|\.|\/\/|@)+[a-z0-9\-\.:@]*)+/i, '')
     end
     stripped_path.empty? ? '/' : stripped_path
   end

data/lib/safe_redirect/version.rb

@@ -1,3 +1,3 @@
 module SafeRedirect
-  VERSION = '0.1.5'
+  VERSION = '0.1.6'
 end

data/spec/lib/safe_redirect/safe_redirect_spec.rb

@@ -63,6 +63,10 @@ module SafeRedirect
       expect(Controller.safe_path('.@@@google.com/search')).to eq('/search')
     end
 
+    it "considers http://////@@@@@@attacker.com//evil.com an unsafe path" do
+      expect(Controller.safe_path('http://////@@@@@@attacker.com//evil.com')).to eq('/')
+    end
+
     it "can use redirect_to method with only the target path" do
       Controller.redirect_to '/'
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: safe_redirect
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
 platform: ruby
 authors:
 - Edwin Tunggawan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-20 00:00:00.000000000 Z
+date: 2016-05-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec