diff --git a/app/models/topic_embed.rb b/app/models/topic_embed.rb index 3ac5de7d8f8..15819bd2604 100644 --- a/app/models/topic_embed.rb +++ b/app/models/topic_embed.rb @@ -126,8 +126,8 @@ class TopicEmbed < ActiveRecord::Base return if uri.blank? begin - html = uri.read - rescue OpenURI::HTTPError, Net::OpenTimeout + html = FinalDestination::HTTP.get(uri) + rescue OpenURI::HTTPError, Net::OpenTimeout, FinalDestination::SSRFDetector::DisallowedIpError return end diff --git a/spec/models/topic_embed_spec.rb b/spec/models/topic_embed_spec.rb index 91aa671cb7b..4b0aab7ab54 100644 --- a/spec/models/topic_embed_spec.rb +++ b/spec/models/topic_embed_spec.rb @@ -299,6 +299,19 @@ RSpec.describe TopicEmbed do response = TopicEmbed.find_remote(url) expect(response.title).to eq("Through the Looking Glass") end + + it "doesn't follow redirect when making request" do + FinalDestination.any_instance.stubs(:resolve).returns(URI("https://redirect.com")) + stub_request(:get, "https://redirect.com/").to_return( + status: 301, + body: "Moved permanently", + headers: { + "Location" => "https://www.example.org/", + }, + ) + response = TopicEmbed.find_remote(url) + expect(response.title).to eq("Moved permanently") + end end context 'with post with allowed classes "foo" and "emoji"' do