studio-engine 0.91.1 → 0.91.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b177cff9fc53b20d566685aa744f1dc41f481017f3014c9a00ef71a43620365a
-  data.tar.gz: 100753f4d2f9dd2f936c8285a2b3aac844d2538099b066ef15013ca77f407392
+  metadata.gz: 270fe9f569b46f626593afa13ce7cf925f23e783541f76e06d6a465d06837278
+  data.tar.gz: 40f8eefcec2e4eee79baa652da57aca97a6b49b794fab4fb3ca166dd3f27333d
 SHA512:
-  metadata.gz: 76433dc917873ff167918968f9ec85d1d6765606e58f3c6502183cab9fca55b3b19a4bc74652f93c74222c3799e4cedbc411a7ce79c6d4d8ff207524982dca20
-  data.tar.gz: 3c69e3e3ed94f63952f9cbf2c2e75446b3d95a7d63c51e5b7331dce801bc5ae5329761b456f6cd968e276d6874daf453dcce551c20b87960c49a604eda81d80e
+  metadata.gz: ae76749cc7fd004b7a93b2108d0af84e21645b1801f50be212d0d5346d503f8d3355fea7c3350ab74a059edbcfc4d60163b245ae34c7f4c68a249e1115b5588f
+  data.tar.gz: 683b4be2cb7b68b01c167db0e3973aefe9b0dd133b8ddb200f5d76f387d19dc1bff6378204fc0e34c4716e1b08bd9e0d08b4f572e40d3b2c15d007e97a6ba48e

data/CHANGELOG.md

@@ -4,6 +4,22 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.91.2 — 2026-10-06
+
+### Security
+
+- **A return path beginning `/\` no longer redirects off-site.** Browsers read
+  `/\evil.com` as `//evil.com`, and the engine's path sanitizers checked only for
+  one leading `/` and not two, so a magic link minted with `return_to=/\evil.com`
+  sent the visitor to another host after sign-in (or, under Rails'
+  `raise_on_open_redirects`, answered 500). One predicate, `Studio::LocalPath.local?`,
+  now holds the rule (one leading `/`, no backslash, no control character) and
+  every engine site uses it: `Studio::LinkToken.sanitize_path`, the link-consume
+  redirect, `Studio::Booking.local_path?`, and the link-preview fallback image.
+  Each site keeps its fallback: a refused return path lands on the default page.
+  Consumers that sanitize a return path themselves should call
+  `Studio::LocalPath.local?` instead of a bare `start_with?("/")` check.
+
 ## 0.91.1 — 2026-10-06
 
 ### Fixed

data/app/controllers/concerns/studio/link_consumption.rb

@@ -163,10 +163,10 @@ module Studio
       user.update!(email_verified_at: Time.current)
     end
 
-    # Only same-origin absolute paths survive; everything else collapses to nil.
+    # Only local paths survive (Studio::LocalPath); everything else collapses to nil.
     def safe_path(path)
       p = path.to_s
-      p.start_with?("/") && !p.start_with?("//") ? p : nil
+      Studio::LocalPath.local?(p) ? p : nil
     end
   end
 end

data/app/models/studio/site_identity.rb

@@ -183,7 +183,7 @@ module Studio
       def static_image
         path = Studio.link_preview_fallback_image.to_s
         return nil if path.empty?
-        return path unless path.start_with?("/") && !path.start_with?("//")
+        return path unless Studio::LocalPath.local?(path)
 
         @static_files ||= Concurrent::Map.new
         present = @static_files.compute_if_absent(path) do
@@ -203,7 +203,7 @@ module Studio
       # per path like static_image.
       def static_image_dimensions
         path = static_image
-        return nil if path.nil? || !path.start_with?("/") || path.start_with?("//")
+        return nil unless Studio::LocalPath.local?(path)
 
         @static_dimensions ||= Concurrent::Map.new
         dims = @static_dimensions.compute_if_absent(path) do

data/lib/studio/booking.rb

@@ -11,6 +11,8 @@
 #
 # `gv=true` is what makes Google serve the embeddable page, so the frame and the
 # popup add it; the "open the booking page" link does not.
+require_relative "local_path"
+
 module Studio
   module Booking
     EMBED_PARAM = "gv=true"
@@ -116,10 +118,10 @@ module Studio
     # hrefs (the footer's booking links, `studio_booking_link`). It begins with
     # one "/" and carries no control character. That refuses a scheme
     # ("javascript:", "https:") and a protocol-relative "//host", which a browser
-    # reads as another site.
+    # reads as another site. The rule is Studio::LocalPath's, shared with every
+    # other engine path sanitizer.
     def local_path?(path)
-      string = path.to_s
-      string.start_with?("/") && !string.start_with?("//") && !string.match?(/[\x00-\x1f\x7f\\]/)
+      Studio::LocalPath.local?(path)
     end
 
     # Studio.booking_path: nil, a local path, or a callable receiving the view.

data/lib/studio/link_token.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "securerandom"
+require_relative "local_path"
 
 module Studio
   # Pure-Ruby helpers behind the Studio::Link model — token minting, the kind
@@ -53,12 +54,13 @@ module Studio
       email.to_s.strip.downcase
     end
 
-    # Only same-origin absolute paths survive; protocol-relative ("//evil"),
+    # Only local paths survive (Studio::LocalPath: one leading "/", no
+    # backslash, no control character); protocol-relative ("//evil", "/\evil"),
     # absolute URLs, and blanks collapse to nil so callers fall back to a safe
-    # default redirect. Mirrors the MagicLink service's sanitizer.
+    # default redirect.
     def sanitize_path(path)
       p = path.to_s
-      p.start_with?("/") && !p.start_with?("//") ? p : nil
+      Studio::LocalPath.local?(p) ? p : nil
     end
   end
 end

data/lib/studio/local_path.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Studio
+  # The one rule for "is this a path on THIS site?", used wherever the engine
+  # writes a caller-supplied path into a redirect or an href: a sign-in's
+  # return_to, a link's target, the booking page, the link-preview fallback image.
+  #
+  # A local path begins with exactly one "/" and carries no control character
+  # and no backslash. Each clause closes a way a browser leaves the site:
+  #   "https://x", "javascript:x"  - no leading "/": a scheme or a relative path
+  #   "//x"                        - protocol-relative: another host
+  #   "/\x", "/\/x"                - browsers (the WHATWG URL parser) read "\" as
+  #                                  "/", so these are "//x" in disguise
+  #   "/\tx", "/\nx"               - the URL parser strips tab and newline, so a
+  #                                  control character can hide a second "/"
+  # Pure Ruby, so it loads and unit-tests without Rails.
+  module LocalPath
+    # A control character (C0 or DEL) or a backslash anywhere in the path.
+    UNSAFE_CHARACTER = /[\x00-\x1f\x7f\\]/
+
+    module_function
+
+    def local?(path)
+      string = path.to_s
+      string.start_with?("/") && !string.start_with?("//") && !string.match?(UNSAFE_CHARACTER)
+    end
+  end
+end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.91.1"
+  VERSION = "0.91.2"
 end

data/lib/studio.rb

@@ -12,6 +12,7 @@ require "active_support/core_ext/module/attribute_accessors"
 require "active_support/core_ext/numeric/time"
 require "active_support/core_ext/integer/time"
 require "studio/version"
+require "studio/local_path"
 require "studio/log_rotation"
 require "studio/ip_locations"
 require "studio/geo"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.91.1
+  version: 0.91.2
 platform: ruby
 authors:
 - Alex McRitchie
@@ -614,6 +614,7 @@ files:
 - lib/studio/link_preview.rb
 - lib/studio/link_resolution.rb
 - lib/studio/link_token.rb
+- lib/studio/local_path.rb
 - lib/studio/log_rotation.rb
 - lib/studio/mail_transport.rb
 - lib/studio/name_parts.rb