Merge pull request #20584 from arthurnn/fix_url

Catch InvalidURIError on bad paths on redirect.

3 files changed, 19 insertions, 4 deletions

diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md
index cb5e7516fb..e8ec3fad73 100644
--- a/actionpack/CHANGELOG.md
+++ b/actionpack/CHANGELOG.md
@@ -1,3 +1,7 @@
+*   Handle InvalidURIError on bad paths on redirect route.
+
+    *arthurnn*
+
 *   Deprecate passing first parameter as `Hash` and default status code for `head` method.
 
     *Mehmet Emin İNAÇ*
diff --git a/actionpack/lib/action_dispatch/routing/redirection.rb b/actionpack/lib/action_dispatch/routing/redirection.rb
index 3c1c4fadf6..8d965a5f8e 100644
--- a/actionpack/lib/action_dispatch/routing/redirection.rb
+++ b/actionpack/lib/action_dispatch/routing/redirection.rb
@@ -23,8 +23,12 @@ module ActionDispatch
 
       def serve(req)
         req.check_path_parameters!
-        uri = URI.parse(path(req.path_parameters, req))
-        
+        begin
+          uri = URI.parse(path(req.path_parameters, req))
+        rescue URI::InvalidURIError
+          return [ 400, {}, ['Invalid path.'] ]
+        end
+
         unless uri.host
           if relative_path?(uri.path)
             uri.path = "#{req.script_name}/#{uri.path}"
@@ -32,7 +36,7 @@ module ActionDispatch
             uri.path = req.script_name.empty? ? "/" : req.script_name
           end
         end
-          
+
         uri.scheme ||= req.scheme
         uri.host   ||= req.host
         uri.port   ||= req.port unless req.standard_port?
@@ -124,7 +128,7 @@ module ActionDispatch
             url_options[:script_name] = request.script_name
           end
         end
-        
+
         ActionDispatch::Http::URL.url_for url_options
       end
 
diff --git a/actionpack/test/journey/router_test.rb b/actionpack/test/journey/router_test.rb
index 802fb93c69..c4bffa2f15 100644
--- a/actionpack/test/journey/router_test.rb
+++ b/actionpack/test/journey/router_test.rb
@@ -219,6 +219,13 @@ module ActionDispatch
         assert_equal 404, resp.first
       end
 
+      def test_invalid_url_path
+        routes = Class.new { include ActionDispatch::Routing::Redirection }.new
+        route = routes.redirect("/foo/bar/%{id}")
+        resp = route.serve(rails_env({ 'REQUEST_METHOD' => 'GET', 'PATH_INFO' => '/foo/(function(){})' }))
+        assert_equal 400, resp.first
+      end
+
       def test_clear_trailing_slash_from_script_name_on_root_unanchored_routes
         route_set = Routing::RouteSet.new
         mapper = Routing::Mapper.new route_set