safe_redirect 0.2.2 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 73595819096734251288a747c73948f27deb1470
-  data.tar.gz: f1f7de8ed97ee7a9bf50dc7e67d687e896d19e40
+  metadata.gz: 9e0bbcba98a1e205b970a2350ad00ee249c29179
+  data.tar.gz: d83b859f1a3dff81021f1b3fa7b872e7592f262e
 SHA512:
-  metadata.gz: 645b2a52d54d86d5e4e023e511c85ec1fc3ff7f057f25561bb430ebd18708ba0fe158756100171263eb0eedbb4c3c096e7bff26c7ec9cebab8bf3f647e9f897f
-  data.tar.gz: f8fc5d77f0eb82bf925abfcb8d701b690d9f40e007bd8df03f1ae33c89928c6a94b81417d196889d64c21fdd9b4f9ef3ab33fcd49d5d9e9cbb9a2628e73377b1
+  metadata.gz: 421f582d00d284e2229790a0a63761a3eb1794cab6ac68435f1d68f378619ee47f08495cab470f962016ad568cdaa1408b3187be13133396ed20355186263897
+  data.tar.gz: 430412ac48189ac16692c3e78e70ef4bac43523e67f33efcae09ab61f49bf9a9a36854d877ebf7dce681323f972a57126e230b05bb0e47ae09b4004688bd7f32

data/lib/safe_redirect/safe_redirect.rb

@@ -2,7 +2,7 @@ require 'uri'
 
 module SafeRedirect
   def safe_domain?(uri)
-    return true if uri.host.nil? && uri.scheme.nil?
+    return true if valid_uri?(uri)
     return false if uri.host.nil?
 
     SafeRedirect.configuration.domain_whitelists.any? do |domain|
@@ -59,4 +59,11 @@ module SafeRedirect
     hash.delete(:host) unless safe_domain?(uri)
     hash
   end
+
+  def valid_uri?(uri)
+    return false unless uri.host.nil? && uri.scheme.nil?
+    return true if uri.path.nil? || uri.path =~ /^\//
+    false
+  end
+
 end

data/lib/safe_redirect/version.rb

@@ -1,3 +1,3 @@
 module SafeRedirect
-  VERSION = '0.2.2'
+  VERSION = '0.2.3'
 end

data/spec/lib/safe_redirect/safe_redirect_spec.rb

@@ -17,6 +17,7 @@ module SafeRedirect
       'http://www.twitter.com',
       'http://blah.foo.org',
       'http://foo.org',
+      'http://foo.org/',
       :back,
       ['some', 'object'],
       { controller: 'home', action: 'index' },
@@ -26,6 +27,8 @@ module SafeRedirect
       "https://www.bukalapak.com@google.com",
       "http://////@@@@@@attacker.com//evil.com",
       "//bukalapak.com%25%40%25%40%25%40%25%40%25%40%25%40%25%40evil.com",
+      "evil.com",
+      ".evil.com",
       "%@%@%@%@%@%@%@%@%@%@evil.com",
       "https://www-bukalapak.com",
       "https://www.bukalapak.com\n.evil.com",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: safe_redirect
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.2.3
 platform: ruby
 authors:
 - Edwin Tunggawan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-08-10 00:00:00.000000000 Z
+date: 2016-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -71,4 +71,3 @@ test_files:
 - spec/lib/safe_redirect/configuration_spec.rb
 - spec/lib/safe_redirect/safe_redirect_spec.rb
 - spec/spec_helper.rb
-has_rdoc: