safe_redirect 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 432d56c2fe2e256b7040f00a82822d9778ef257c
-  data.tar.gz: 4cd2ccdf44e92e79d613b5ad960b81f486a80009
+  metadata.gz: 73595819096734251288a747c73948f27deb1470
+  data.tar.gz: f1f7de8ed97ee7a9bf50dc7e67d687e896d19e40
 SHA512:
-  metadata.gz: e615e2700b962aae967a8894aef1af26484d5ccf7ba1b4c8868090ea49f426f9007ec0e5950f93dc20cb7624049c3d0129fe963470be00073da1f741de92b023
-  data.tar.gz: 71d7558aac96b2a794daf3edb895998b8321b4e03fbde1ed182964612171d8252469034d6927ebc483b7a7b04b682466fd16da987c31c3be71321ba27ce9e2fb
+  metadata.gz: 645b2a52d54d86d5e4e023e511c85ec1fc3ff7f057f25561bb430ebd18708ba0fe158756100171263eb0eedbb4c3c096e7bff26c7ec9cebab8bf3f647e9f897f
+  data.tar.gz: f8fc5d77f0eb82bf925abfcb8d701b690d9f40e007bd8df03f1ae33c89928c6a94b81417d196889d64c21fdd9b4f9ef3ab33fcd49d5d9e9cbb9a2628e73377b1

data/README.md

@@ -21,6 +21,14 @@ SafeRedirect.configure do |config|
 end
 ```
 
+We can also use wildcard subdomain on domain whitelists (thanks to [Mike Campbell](https://github.com/mikecmpbll)).
+
+```rb
+SafeRedirect.configure do |config|
+  config.domain_whitelists = ['*.foo.org'] # whitelisting foo.org, m.foo.org, www.foo.org, ...
+end
+```
+
 Add this line to the controllers you wish to secure from open redirection.
 
 ```rb

data/lib/safe_redirect/configuration.rb

@@ -12,11 +12,20 @@ module SafeRedirect
   end
 
   class Configuration
-    attr_accessor :default_path, :domain_whitelists
+    attr_accessor :default_path
+    attr_reader :domain_whitelists
 
     def initialize
       self.default_path = '/'
       self.domain_whitelists = []
     end
+
+    def domain_whitelists=(whitelists)
+      if whitelists.any?{ |w| w =~ /\*\z/ }
+        raise ArgumentError, "whitelisted domain cannot end with a glob (*)"
+      end
+
+      @domain_whitelists = whitelists
+    end
   end
 end

data/lib/safe_redirect/safe_redirect.rb

@@ -3,17 +3,37 @@ require 'uri'
 module SafeRedirect
   def safe_domain?(uri)
     return true if uri.host.nil? && uri.scheme.nil?
-    SafeRedirect.configuration.domain_whitelists.include?(uri.host)
+    return false if uri.host.nil?
+
+    SafeRedirect.configuration.domain_whitelists.any? do |domain|
+      if domain.include?("*")
+        rf = domain.split(/(\*)/).map{ |f| f == "*" ? "\\w*" : Regexp.escape(f) }
+        regexp = Regexp.new("\\A#{rf.join}\\z")
+
+        safe = uri.host.match(regexp)
+
+        # if domain starts with *. and contains no other wildcards, include the
+        # naked domain too (e.g. foo.org when *.foo.org is the whitelist)
+        if domain =~ /\A\*\.[^\*]+\z/
+          naked_domain = domain.gsub("*.", "")
+          safe || uri.host == naked_domain
+        else
+          safe
+        end
+      else
+        uri.host == domain
+      end
+    end
   end
 
   def safe_path(path)
     case path
     when String
       clean_path(path)
-    when Symbol, Hash
-      path
+    when Hash
+      sanitize_hash(path)
     else
-      SafeRedirect.configuration.default_path
+      path
     end
   end
 
@@ -27,8 +47,16 @@ module SafeRedirect
 
   def clean_path(path)
     uri = URI.parse(path)
-    safe_domain?(uri) ? path : '/'
+    safe_domain?(uri) ? path : SafeRedirect.configuration.default_path
   rescue URI::InvalidURIError
-    '/'
+    SafeRedirect.configuration.default_path
+  end
+
+  def sanitize_hash(hash)
+    protocol = hash[:protocol] || 'http'
+    host = hash[:host]
+    uri = URI.parse("#{protocol}://#{host}")
+    hash.delete(:host) unless safe_domain?(uri)
+    hash
   end
 end

data/lib/safe_redirect/version.rb

@@ -1,3 +1,3 @@
 module SafeRedirect
-  VERSION = '0.2.1'
+  VERSION = '0.2.2'
 end

data/spec/lib/safe_redirect/configuration_spec.rb

@@ -6,6 +6,16 @@ module SafeRedirect
       reset_config
     end
 
+    it 'errors if you try to end whitelisted domain with glob' do
+      config_update = -> do
+        SafeRedirect.configure do |config|
+          config.domain_whitelists = ["foo.*"]
+        end
+      end
+
+      expect(config_update).to raise_error(ArgumentError)
+    end
+
     it 'default default_path is /' do
       expect(SafeRedirect.configuration.default_path).to eq('/')
     end

data/spec/lib/safe_redirect/safe_redirect_spec.rb

@@ -15,8 +15,11 @@ module SafeRedirect
       '/',
       '/foobar',
       'http://www.twitter.com',
+      'http://blah.foo.org',
+      'http://foo.org',
       :back,
-      { controller: 'home', action: 'index' }
+      ['some', 'object'],
+      { controller: 'home', action: 'index' },
     ]
 
     UNSAFE_PATHS = [
@@ -26,6 +29,7 @@ module SafeRedirect
       "%@%@%@%@%@%@%@%@%@%@evil.com",
       "https://www-bukalapak.com",
       "https://www.bukalapak.com\n.evil.com",
+      "http://blah.blah.foo.org",
     ]
 
     SAFE_PATHS.each do |path|
@@ -36,10 +40,16 @@ module SafeRedirect
 
     UNSAFE_PATHS.each do |path|
       it "considers #{path} an unsafe path" do
-        expect(Controller.safe_path(path)).to eq('/')
+        expect(Controller.safe_path(path)).to eq(SafeRedirect.configuration.default_path)
       end
     end
 
+    it 'filters host, port, and protocol options when hash is passed to safe_path' do
+      hash = { host: 'yahoo.com', port: 80, protocol: 'https', controller: 'home', action: 'index' }
+      safe_hash = { port: 80, protocol: 'https', controller: 'home', action: 'index' }
+      expect(Controller.safe_path(hash)).to eq(safe_hash)
+    end
+
     it 'can use redirect_to method with only the target path' do
       Controller.redirect_to '/'
     end

data/spec/spec_helper.rb

@@ -10,7 +10,7 @@ end
 def load_config
   SafeRedirect.configure do |config|
     config.default_path = '/sdsdkkk'
-    config.domain_whitelists = ['www.twitter.com', 'www.bukalapak.com']
+    config.domain_whitelists = %w{www.twitter.com www.bukalapak.com *.foo.org}
   end
 end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: safe_redirect
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - Edwin Tunggawan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-08-05 00:00:00.000000000 Z
+date: 2016-08-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -71,3 +71,4 @@ test_files:
 - spec/lib/safe_redirect/configuration_spec.rb
 - spec/lib/safe_redirect/safe_redirect_spec.rb
 - spec/spec_helper.rb
+has_rdoc: