Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
discourse/spec/services/wildcard_url_checker_spec.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

53 lines
1.9 KiB
Ruby
Raw Normal View History

SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
# frozen_string_literal: true
require 'rails_helper'
describe WildcardUrlChecker do
describe 'check_url' do
context 'valid url' do
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
it 'returns true' do
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result1 = described_class.check_url('https://*.discourse.org', 'https://anything.is.possible.discourse.org')
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result1).to eq(true)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result2 = described_class.check_url('https://www.discourse.org', 'https://www.discourse.org')
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result2).to eq(true)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result3 = described_class.check_url('*', 'https://hello.discourse.org')
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result3).to eq(true)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result4 = described_class.check_url('discourse://auth_redirect', 'discourse://auth_redirect')
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result4).to eq(true)
result5 = described_class.check_url('customprotocol://www.discourse.org', "customprotocol://www.discourse.org")
expect(result5).to eq(true)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
end
end
context 'invalid domain' do
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
it "returns false" do
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result1 = described_class.check_url('https://*.discourse.org', 'https://bad-domain.discourse.org.evil.com')
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result1).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result2 = described_class.check_url('https://www.discourse.org', 'https://www.discourse.org.evil.com')
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result2).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result3 = described_class.check_url('https://www.discourse.org', 'https://www.www.discourse.org')
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result3).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result4 = described_class.check_url('https://www.discourse.org', "https://www.discourse.org\nwww.discourse.org.evil.com")
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result4).to eq(false)
result5 = described_class.check_url('https://', "https://")
expect(result5).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
result6 = described_class.check_url('invalid$protocol://www.discourse.org', "invalid$protocol://www.discourse.org")
expect(result6).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
result7 = described_class.check_url('noscheme', "noscheme")
expect(result7).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
end
end
end
end