Commit 59a2123d authored by Kamil Trzciński's avatar Kamil Trzciński

Merge branch 'ce-jej/sanitize-group-saml-relay-state' into 'master'

[CE backport] Backport InternalRedirect#sanitize_redirect

See merge request gitlab-org/gitlab-ce!19795
parents f39582f7 202bd2da
...@@ -23,6 +23,10 @@ module InternalRedirect ...@@ -23,6 +23,10 @@ module InternalRedirect
nil nil
end end
def sanitize_redirect(url_or_path)
safe_redirect_path(url_or_path) || safe_redirect_path_for_url(url_or_path)
end
def host_allowed?(uri) def host_allowed?(uri)
uri.host == request.host && uri.host == request.host &&
uri.port == request.port uri.port == request.port
......
...@@ -54,6 +54,31 @@ describe InternalRedirect do ...@@ -54,6 +54,31 @@ describe InternalRedirect do
end end
end end
describe '#sanitize_redirect' do
let(:valid_path) { '/hello/world?hello=world' }
let(:valid_url) { "http://test.host#{valid_path}" }
it 'returns `nil` for invalid paths' do
invalid_path = '//not/valid'
expect(controller.sanitize_redirect(invalid_path)).to eq nil
end
it 'returns `nil` for invalid urls' do
input = 'http://test.host:3000/invalid'
expect(controller.sanitize_redirect(input)).to eq nil
end
it 'returns input for valid paths' do
expect(controller.sanitize_redirect(valid_path)).to eq valid_path
end
it 'returns path for valid urls' do
expect(controller.sanitize_redirect(valid_url)).to eq valid_path
end
end
describe '#host_allowed?' do describe '#host_allowed?' do
it 'allows uris with the same host and port' do it 'allows uris with the same host and port' do
expect(controller.host_allowed?(URI('http://test.host/test'))).to be(true) expect(controller.host_allowed?(URI('http://test.host/test'))).to be(true)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment