Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
discourse/spec/services/wildcard_url_checker_spec.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

77 lines
2.2 KiB
Ruby
Raw Normal View History

SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
# frozen_string_literal: true
Add RSpec 4 compatibility (#17652) * Remove outdated option https://github.com/rspec/rspec-core/commit/04078317ba6577699d06cf4dccf014254dcde7a6 * Use the non-globally exposed RSpec syntax https://github.com/rspec/rspec-core/pull/2803 * Use the non-globally exposed RSpec syntax, cont https://github.com/rspec/rspec-core/pull/2803 * Comply to strict predicate matchers See: - https://github.com/rspec/rspec-expectations/pull/1195 - https://github.com/rspec/rspec-expectations/pull/1196 - https://github.com/rspec/rspec-expectations/pull/1277
2022-07-27 22:27:38 -04:00
RSpec.describe WildcardUrlChecker do
DEV: Use proper wording for contexts in specs
2022-07-27 12:14:14 -04:00
describe ".check_url" do
context "when url is valid" do
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
it "returns true" do
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result1 =
described_class.check_url(
"https://*.discourse.org",
"https://anything.is.possible.discourse.org",
)
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result1).to eq(true)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result2 =
described_class.check_url("https://www.discourse.org", "https://www.discourse.org")
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result2).to eq(true)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result3 = described_class.check_url("*", "https://hello.discourse.org")
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result3).to eq(true)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result4 =
described_class.check_url("discourse://auth_redirect", "discourse://auth_redirect")
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result4).to eq(true)
result5 =
described_class.check_url(
"customprotocol://www.discourse.org",
"customprotocol://www.discourse.org",
)
expect(result5).to eq(true)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
end
end
DEV: Use proper wording for contexts in specs
2022-07-27 12:14:14 -04:00
context "when url is invalid" do
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
it "returns false" do
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result1 =
described_class.check_url(
"https://*.discourse.org",
"https://bad-domain.discourse.org.evil.com",
)
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result1).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result2 =
described_class.check_url(
"https://www.discourse.org",
"https://www.discourse.org.evil.com",
)
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result2).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result3 =
described_class.check_url("https://www.discourse.org", "https://www.www.discourse.org")
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result3).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
result4 =
described_class.check_url(
"https://www.discourse.org",
"https://www.discourse.org\nwww.discourse.org.evil.com",
)
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
expect(result4).to eq(false)
result5 = described_class.check_url("https://", "https://")
expect(result5).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
result6 =
described_class.check_url(
"invalid$protocol://www.discourse.org",
"invalid$protocol://www.discourse.org",
)
expect(result6).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
FIX: Allow any protocol in wildcard url checker (#8651) This is required for people using apps with custom protocols. We still verify the entire URL (including protocol) against the site setting value. Refactored wildcard_url_checker so that it always returns a boolean, rather than sometimes returning a regex match.
2020-01-02 11:03:13 -05:00
result7 = described_class.check_url("noscheme", "noscheme")
expect(result7).to eq(false)
SECURITY: vulnerability in WildcardUrlChecker
2019-12-12 21:12:12 -05:00
end
end
end
end