Fix the Command Injection warnings from Brakeman

[rails.git] / lib / short_link.rb

diff --git a/lib/short_link.rb b/lib/short_link.rb
index 69634cea54efb4c4a6c82fc7b8cca575c6183cf7..ec83ce33fc48d276acdf74d86c50f688e46d4ad1 100644 (file)
--- a/lib/short_link.rb
+++ b/lib/short_link.rb
@@ -10,78 +10,80 @@ module ShortLink
   # URL-friendly.
   ARRAY = ("A".."Z").to_a + ("a".."z").to_a + ("0".."9").to_a + ["_", "~"]
 
-  ##
-  # Given a string encoding a location, returns the [lon, lat, z] tuple of that
-  # location.
-  def self.decode(str)
-    x = 0
-    y = 0
-    z = 0
-    z_offset = 0
+  class << self
+    ##
+    # Given a string encoding a location, returns the [lon, lat, z] tuple of that
+    # location.
+    def decode(str)
+      x = 0
+      y = 0
+      z = 0
+      z_offset = 0
 
-    # keep support for old shortlinks which use the @ character, now
-    # replaced by the ~ character because twitter is horribly broken
-    # and we can't have that.
-    str.gsub!("@", "~")
+      # keep support for old shortlinks which use the @ character, now
+      # replaced by the ~ character because twitter is horribly broken
+      # and we can't have that.
+      str.tr!("@", "~")
 
-    str.each_char do |c|
-      t = ARRAY.index c
-      if t.nil?
-        z_offset -= 1
-      else
-        3.times do
-          x <<= 1
-          x |= 1 unless (t & 32).zero?
-          t <<= 1
+      str.each_char do |c|
+        t = ARRAY.index c
+        if t.nil?
+          z_offset -= 1
+        else
+          3.times do
+            x <<= 1
+            x |= 1 unless (t & 32).zero?
+            t <<= 1
 
-          y <<= 1
-          y |= 1 unless (t & 32).zero?
-          t <<= 1
+            y <<= 1
+            y |= 1 unless (t & 32).zero?
+            t <<= 1
+          end
+          z += 3
         end
-        z += 3
       end
+      # pack the coordinates out to their original 32 bits.
+      x <<= (32 - z)
+      y <<= (32 - z)
+
+      # project the parameters back to their coordinate ranges.
+      [(x * 360.0 / 2**32) - 180.0,
+       (y * 180.0 / 2**32) - 90.0,
+       z - 8 - (z_offset % 3)]
     end
-    # pack the coordinates out to their original 32 bits.
-    x <<= (32 - z)
-    y <<= (32 - z)
 
-    # project the parameters back to their coordinate ranges.
-    [(x * 360.0 / 2**32) - 180.0,
-     (y * 180.0 / 2**32) - 90.0,
-     z - 8 - (z_offset % 3)]
-  end
+    ##
+    # given a location and zoom, return a short string representing it.
+    def encode(lon, lat, z)
+      code = interleave_bits(((lon + 180.0) * 2**32 / 360.0).to_i,
+                             ((lat + 90.0) * 2**32 / 180.0).to_i)
+      str = ""
+      # add eight to the zoom level, which approximates an accuracy of
+      # one pixel in a tile.
+      ((z + 8) / 3.0).ceil.times do |i|
+        digit = (code >> (58 - 6 * i)) & 0x3f
+        str << ARRAY[digit]
+      end
+      # append characters onto the end of the string to represent
+      # partial zoom levels (characters themselves have a granularity
+      # of 3 zoom levels).
+      ((z + 8) % 3).times { str << "-" }
 
-  ##
-  # given a location and zoom, return a short string representing it.
-  def self.encode(lon, lat, z)
-    code = interleave_bits(((lon + 180.0) * 2**32 / 360.0).to_i,
-                           ((lat +  90.0) * 2**32 / 180.0).to_i)
-    str = ""
-    # add eight to the zoom level, which approximates an accuracy of
-    # one pixel in a tile.
-    ((z + 8) / 3.0).ceil.times do |i|
-      digit = (code >> (58 - 6 * i)) & 0x3f
-      str << ARRAY[digit]
+      str
     end
-    # append characters onto the end of the string to represent
-    # partial zoom levels (characters themselves have a granularity
-    # of 3 zoom levels).
-    ((z + 8) % 3).times { str << "-" }
 
-    str
-  end
-
-  private
+    private
 
-  ##
-  # interleaves the bits of two 32-bit numbers. the result is known
-  # as a Morton code.
-  def self.interleave_bits(x, y)
-    c = 0
-    31.downto(0) do |i|
-      c = (c << 1) | ((x >> i) & 1)
-      c = (c << 1) | ((y >> i) & 1)
+    ##
+    # interleaves the bits of two 32-bit numbers. the result is known
+    # as a Morton code.
+    def interleave_bits(x, y)
+      c = 0
+      31.downto(0) do |i|
+        c = (c << 1) | ((x >> i) & 1)
+        c = (c << 1) | ((y >> i) & 1)
+      end
+      c
     end
-    c
   end
 end