safe_redirect_rails 0.1.6 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5752a7e363f7624fdcb1ecf452ff6256e88a5375e82ed10e5979fedf166db456
-  data.tar.gz: 6d517a3e27aa9dc8ecc3fded35a08e51b7657a93c73fcdf5671c4b1ad2574140
+  metadata.gz: 16bb809106293e6a9bf0fbb97bf12f688eaa23781c070153e2f42430df463c8c
+  data.tar.gz: 768d2f697275051f6c6b42d3981f2d3e7bae73822265f4dbb6e7452b0f469941
 SHA512:
-  metadata.gz: 15b26e77981ad317ff06f3f2d42039e5b5ac08fe840d8c3ee581708c6d7204a95ccb51226e043f5764dd2d90dcde9dd69c3377ebb7c00e9d985bc04de125e715
-  data.tar.gz: 16cb6c976afd4e4ab480fe3d03286bab6b7760336f4d302566f54fd2ae3abc06d337f30f3cb43f4dca5d12dbc9d8e7e5fc3196b3753221aac725783635509fbc
+  metadata.gz: 910b4b243faf8d7069f0da4ffd71ad02fda3624bd3faa5a4efe49dbd138abfec2cbc3ebdcbb5cf72cc585d50759e557382d0d39ae0b0095f64d44630e65c225c
+  data.tar.gz: ea4e0b19f33caf1a8101e8dafe2162d268c9bff26372e18f6793541755e5270457fb0ac997e9bf63a8554e7424b9de1900e5475ed69432e25b710d0014f02ec2

data/lib/safe_redirect_rails/safe_redirect_rails.rb

@@ -7,24 +7,9 @@ module SafeRedirectRails
     return true if valid_uri?(uri)
     return false if uri.host.nil?
 
-    SafeRedirectRails.configuration.domain_whitelists.any? do |domain|
-      if domain.include?("*")
-        rf = domain.split(/(\*)/).map{ |f| f == "*" ? "[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9]?" : Regexp.escape(f) }
-        regexp = Regexp.new("\\A#{rf.join}\\z")
-
-        safe = uri.host.match(regexp)
-
-        # if domain starts with *. and contains no other wildcards, include the
-        # naked domain too (e.g. foo.org when *.foo.org is the whitelist)
-        if domain =~ /\A\*\.[^\*]+\z/
-          naked_domain = domain.gsub("*.", "")
-          safe || uri.host == naked_domain
-        else
-          safe
-        end
-      else
-        uri.host == domain
-      end
+    SafeRedirectRails.configuration.domain_whitelists.any? do |pattern|
+      regexp = domain_pattern_to_regex(pattern)
+      uri.host.match?(regexp)
     end
   end
 
@@ -99,4 +84,10 @@ module SafeRedirectRails
     end
   end
 
+  def domain_pattern_to_regex(pattern)
+    escaped = pattern.split("*").map { |part| Regexp.escape(part) }.join("*")
+    regex_str = "^" + escaped.gsub("*", "[A-Za-z0-9\-]+") + "$"
+    Regexp.new(regex_str)
+  end
+
 end

data/lib/safe_redirect_rails/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SafeRedirectRails
-  VERSION = "0.1.6"
+  VERSION = "0.1.7"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: safe_redirect_rails
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.1.7
 platform: ruby
 authors:
 - Tuan Pham
 bindir: bin
 cert_chain: []
-date: 2025-03-21 00:00:00.000000000 Z
+date: 2025-06-09 00:00:00.000000000 Z
 dependencies: []
 description: This gem provides a simple way to redirect to safe URLs
 email: