safe_redirect 0.2.4 → 0.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 336f84a6b03db00df68f1f76be936b3e199cd829
-  data.tar.gz: f65b82666b23abce9eeb46e310aef4526ca9d5f1
+  metadata.gz: 8ff898728ac428398f321deade8d5e2cf36f1631
+  data.tar.gz: 9c4e7f8d11df8507ba04f1ad85e1fb38d9da1e4f
 SHA512:
-  metadata.gz: e8c77143c12ec4d810fa92554dd22fb7277aaad3552b927b3dc817565b5a0996ffabcd299cb968a5f7a82df8f4210934d71178a8092b79b46d0774aebf81d3f6
-  data.tar.gz: 50d512e6af84ad7353914b1406eacc80208f5874d9787edbea9707afc49415081b6702e6953f1537a1c1c6000188ad6e0ffc8d83638f8beb4169f3648bcaf632
+  metadata.gz: 7c92e3e71cfae64d3ca4e64f66b64bd2106aab23b5f4e6cb36a68059a7122063fc5227354cdae928f333baa589d61af2560eca54766b44b291f43bea71c7302c
+  data.tar.gz: fe073f08cee215ff1471d6b75e007ce6b3057ae0c735dab60c699b412b5c5a0b1f8dc29ccf30059eeb8afd622ed34f5917803da938d0e5602bb40f18418b0eca

data/lib/safe_redirect/configuration.rb

@@ -12,11 +12,12 @@ module SafeRedirect
   end
 
   class Configuration
-    attr_accessor :default_path
+    attr_accessor :default_path, :whitelist_local
     attr_reader :domain_whitelists
 
     def initialize
       self.default_path = '/'
+      self.whitelist_local = false
       self.domain_whitelists = []
     end
 

data/lib/safe_redirect/safe_redirect.rb

@@ -61,6 +61,7 @@ module SafeRedirect
   end
 
   def valid_uri?(uri)
+    return true if uri.host && whitelist_local? && local_address?(uri.host)
     return false unless uri.host.nil? && uri.scheme.nil?
     return true if uri.path.nil? || uri.path =~ /^\//
     false
@@ -70,4 +71,13 @@ module SafeRedirect
     path !~ /\/\/\//
   end
 
+  def whitelist_local?
+    SafeRedirect.configuration.whitelist_local
+  end
+
+  # borrowed the regex from https://github.com/rack/rack/blob/ea9e7a570b7ffd8ac6845a9ebecdd7de0af6b0ca/lib/rack/request.rb#L420
+  def local_address?(host)
+    host =~ /\A127\.0\.0\.1\Z|\A(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\.|\A::1\Z|\Afd[0-9a-f]{2}:.+|\Alocalhost\Z|\Aunix\Z|\Aunix:/i
+  end
+
 end

data/lib/safe_redirect/version.rb

@@ -1,3 +1,3 @@
 module SafeRedirect
-  VERSION = '0.2.4'
+  VERSION = '0.2.5'
 end

data/spec/lib/safe_redirect/configuration_spec.rb

@@ -20,6 +20,10 @@ module SafeRedirect
       expect(SafeRedirect.configuration.default_path).to eq('/')
     end
 
+    it 'default whitelist_local is false' do
+      expect(SafeRedirect.configuration.whitelist_local).to eq(false)
+    end
+
     it 'default domain_whitelists is []' do
       expect(SafeRedirect.configuration.domain_whitelists).to eq([])
     end
@@ -31,6 +35,13 @@ module SafeRedirect
       expect(SafeRedirect.configuration.default_path).to eq('https://www.bukalapak.com')
     end
 
+    it 'can update whitelist_local' do
+      SafeRedirect.configure do |config|
+        config.whitelist_local = true
+      end
+      expect(SafeRedirect.configuration.whitelist_local).to eq(true)
+    end
+
     it 'can update domain_whitelists' do
       SafeRedirect.configure do |config|
         config.domain_whitelists = ['www.bukalapak.com']

data/spec/lib/safe_redirect/safe_redirect_spec.rb

@@ -5,10 +5,6 @@ module SafeRedirect
     class Controller
       extend SafeRedirect
     end
-  
-    before(:all) do
-      load_config
-    end
 
     SAFE_PATHS = [
       'https://www.bukalapak.com',
@@ -36,30 +32,60 @@ module SafeRedirect
       "///bit.ly/1hqE77G",
     ]
 
-    SAFE_PATHS.each do |path|
-      it "considers #{path} a safe path" do
-        expect(Controller.safe_path(path)).to eq(path)
+    shared_examples_for 'nonlocal hosts' do
+      SAFE_PATHS.each do |path|
+        it "considers #{path} a safe path" do
+          expect(Controller.safe_path(path)).to eq(path)
+        end
+      end
+
+      UNSAFE_PATHS.each do |path|
+        it "considers #{path} an unsafe path" do
+          expect(Controller.safe_path(path)).to eq(SafeRedirect.configuration.default_path)
+        end
+      end
+
+      it 'filters host, port, and protocol options when hash is passed to safe_path' do
+        hash = { host: 'yahoo.com', port: 80, protocol: 'https', controller: 'home', action: 'index' }
+        safe_hash = { port: 80, protocol: 'https', controller: 'home', action: 'index' }
+        expect(Controller.safe_path(hash)).to eq(safe_hash)
+      end
+
+      it 'can use redirect_to method with only the target path' do
+        Controller.redirect_to '/'
+      end
+
+      it 'can use redirect_to method with both the target path and the options' do
+        Controller.redirect_to '/', notice: 'Back to home page'
       end
     end
 
-    UNSAFE_PATHS.each do |path|
-      it "considers #{path} an unsafe path" do
+    context 'whitelist_local is not set' do
+  
+      before(:all) do
+        load_config
+      end
+
+      it_should_behave_like 'nonlocal hosts'
+
+      it 'considers local addresses as unsafe' do
+        path = 'http://127.0.0.1'
         expect(Controller.safe_path(path)).to eq(SafeRedirect.configuration.default_path)
       end
     end
 
-    it 'filters host, port, and protocol options when hash is passed to safe_path' do
-      hash = { host: 'yahoo.com', port: 80, protocol: 'https', controller: 'home', action: 'index' }
-      safe_hash = { port: 80, protocol: 'https', controller: 'home', action: 'index' }
-      expect(Controller.safe_path(hash)).to eq(safe_hash)
-    end
+    context 'whitelist_local is set' do
+  
+      before(:all) do
+        load_config true
+      end
 
-    it 'can use redirect_to method with only the target path' do
-      Controller.redirect_to '/'
-    end
+      it_should_behave_like 'nonlocal hosts'
 
-    it 'can use redirect_to method with both the target path and the options' do
-      Controller.redirect_to '/', notice: 'Back to home page'
+      it 'considers local addresses as safe' do
+        path = 'http://127.0.0.1'
+        expect(Controller.safe_path(path)).to eq(path)
+      end
     end
   end
 end

data/spec/spec_helper.rb

@@ -7,10 +7,11 @@ def reset_config
   SafeRedirect.reset_config
 end
 
-def load_config
+def load_config(whitelist_local = false)
   SafeRedirect.configure do |config|
     config.default_path = '/sdsdkkk'
     config.domain_whitelists = %w{www.twitter.com www.bukalapak.com *.foo.org}
+    config.whitelist_local = whitelist_local
   end
 end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: safe_redirect
 version: !ruby/object:Gem::Version
-  version: 0.2.4
+  version: 0.2.5
 platform: ruby
 authors:
 - Edwin Tunggawan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-01-09 00:00:00.000000000 Z
+date: 2017-06-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -71,3 +71,4 @@ test_files:
 - spec/lib/safe_redirect/configuration_spec.rb
 - spec/lib/safe_redirect/safe_redirect_spec.rb
 - spec/spec_helper.rb
+has_rdoc: