diff options
author | Rafael França <rafaelmfranca@gmail.com> | 2015-11-04 16:12:54 -0200 |
---|---|---|
committer | Rafael França <rafaelmfranca@gmail.com> | 2015-11-04 16:12:54 -0200 |
commit | e8b2c0535c203119e6733a982dc22734f3da1219 (patch) | |
tree | b267f45708bcb26f186812d57715f9c73134428c /actionview/lib | |
parent | 1e2f6bccc8bd2d5c8b40115c46bb4846cd673ed7 (diff) | |
parent | ab5fb4f22430afa58c334f7e7e142660164490e5 (diff) | |
download | rails-e8b2c0535c203119e6733a982dc22734f3da1219.tar.gz rails-e8b2c0535c203119e6733a982dc22734f3da1219.tar.bz2 rails-e8b2c0535c203119e6733a982dc22734f3da1219.zip |
Merge pull request #22180 from usertesting/arbitrary-url-in-link-to-back
Don’t allow arbitrary data in back urls
Diffstat (limited to 'actionview/lib')
-rw-r--r-- | actionview/lib/action_view/helpers/url_helper.rb | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/actionview/lib/action_view/helpers/url_helper.rb b/actionview/lib/action_view/helpers/url_helper.rb index 5684de35e8..baebc34b4b 100644 --- a/actionview/lib/action_view/helpers/url_helper.rb +++ b/actionview/lib/action_view/helpers/url_helper.rb @@ -41,11 +41,21 @@ module ActionView end def _back_url # :nodoc: - referrer = controller.respond_to?(:request) && controller.request.env["HTTP_REFERER"] - referrer || 'javascript:history.back()' + _filtered_referrer || 'javascript:history.back()' end protected :_back_url + def _filtered_referrer # :nodoc: + if controller.respond_to?(:request) + referrer = controller.request.env["HTTP_REFERER"] + if referrer && URI(referrer).scheme != 'javascript' + referrer + end + end + rescue URI::InvalidURIError + end + protected :_filtered_referrer + # Creates an anchor element of the given +name+ using a URL created by the set of +options+. # See the valid options in the documentation for +url_for+. It's also possible to # pass a String instead of an options hash, which generates an anchor element that uses the |