From d951621c4488c58ec6caf12daf81a2b048fd40b1 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Tue, 23 Nov 2021 11:27:02 +0000 Subject: [PATCH] Make safe_referer handle invalid URIs --- app/controllers/application_controller.rb | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 517b11e14..d0898bf5e 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -381,18 +381,22 @@ class ApplicationController < ActionController::Base # clean any referer parameter def safe_referer(referer) - referer = URI.parse(referer) + begin + referer = URI.parse(referer) + + if referer.scheme == "http" || referer.scheme == "https" + referer.scheme = nil + referer.host = nil + referer.port = nil + elsif referer.scheme || referer.host || referer.port + referer = nil + end - if referer.scheme == "http" || referer.scheme == "https" - referer.scheme = nil - referer.host = nil - referer.port = nil - elsif referer.scheme || referer.host || referer.port + referer = nil if referer&.path&.first != "/" + rescue URI::InvalidURIError referer = nil end - referer = nil if referer&.path&.first != "/" - referer.to_s end -- 2.39.5