safe_redirect 0.1.8 → 0.1.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9bea54db6f46e150f339c0a34d2778c5a0ccb9ec
-  data.tar.gz: 1df29a162b56ac46989c29d1f06285cbd25da584
+  metadata.gz: 846ca148f882664845dd48c74c4b210b09101554
+  data.tar.gz: fb1a59ccad4d4065ecffcbe5777150f07f657919
 SHA512:
-  metadata.gz: 5eceec28da87fa63b50e530c9529f56bd4fbdbeaea2f5c11329c4ca8b7dc60e9c4f87bedddf08250f86fff956933367332392131caf4be1b680883a39918453d
-  data.tar.gz: 574dcad181101890960caea28171a47f4d3e621c0afa561d804795afd18d4d3a832a05e9dc30d894069a39d9b19fba5b6de40dbd7a3cfcf4452e9c0c92f58c80
+  metadata.gz: 4c89105fbf5b35697f8182b74a50a46863bd43f30e4c78f8d0cd8b4e800b952ce9892528f9abfd7cc6fc75ffc2afe62292845c216b26f3b99857954259f388ca
+  data.tar.gz: f52475eb7900bc3872dff9da34a89258ad0f0b486efcd67b623568edfdf25a0dbdcb41d545de16576bb0b2577a225a6270ca75225c2563ecf91d1fe7ca0252f8

data/lib/safe_redirect/safe_redirect.rb

@@ -29,7 +29,7 @@ module SafeRedirect
     stripped_path = path.strip
     unless safe_domain?(stripped_path)
       stripped_path.gsub!(/https?:\/\/[a-z0-9\-\.:@]*/i, '')
-      stripped_path.gsub!(/^((https?:|data:|javascript:|\.|\/\/|@|%25%40)+[a-z0-9\-\.:@%]*)+/i, '')
+      stripped_path.gsub!(/^((https?:|data:|javascript:|\.|\/\/|@|%)+[a-z0-9\-\.:@%]*)+/i, '')
     end
     stripped_path.empty? ? '/' : stripped_path
   end

data/lib/safe_redirect/version.rb

@@ -1,3 +1,3 @@
 module SafeRedirect
-  VERSION = '0.1.8'
+  VERSION = '0.1.9'
 end

data/spec/lib/safe_redirect/safe_redirect_spec.rb

@@ -67,6 +67,19 @@ module SafeRedirect
       expect(Controller.safe_path('http://////@@@@@@attacker.com//evil.com')).to eq('/')
     end
 
+    it "considers //bukalapak.com%25%40%25%40%25%40%25%40%25%40%25%40%25%40evil.com an unsafe path" do
+      expect(Controller.safe_path('//bukalapak.com%25%40%25%40%25%40%25%40%25%40%25%40%25%40evil.com')).to eq('/')
+    end
+
+    it "considers %25%40%25%40%25%40%25%40%25%40%25%40%25%40%25%40%25%40%25%40evil.com an unsafe path" do
+      expect(Controller.safe_path('%25%40%25%40%25%40%25%40%25%40%25%40%25%40%25%40%25%40%25%40evil.com')).to eq('/')
+    end
+
+
+    it "considers %@%@%@%@%@%@%@%@%@%@evil.com an unsafe path" do
+      expect(Controller.safe_path('%@%@%@%@%@%@%@%@%@%@evil.com')).to eq('/')
+    end
+
     it "can use redirect_to method with only the target path" do
       Controller.redirect_to '/'
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: safe_redirect
 version: !ruby/object:Gem::Version
-  version: 0.1.8
+  version: 0.1.9
 platform: ruby
 authors:
 - Edwin Tunggawan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-06-10 00:00:00.000000000 Z
+date: 2016-06-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec