From ee65ca46e589e14484c80b35c46c9aff26769d86 Mon Sep 17 00:00:00 2001 From: Yuichi Takeuchi Date: Sat, 19 Jan 2019 15:50:56 +0900 Subject: Fix ArgumentError: Unsafe redirect --- .../test/controllers/blobs_controller_test.rb | 25 ++++++++++++++++++ .../controllers/representations_controller_test.rb | 30 ++++++++++++++++++++++ 2 files changed, 55 insertions(+) (limited to 'activestorage/test') diff --git a/activestorage/test/controllers/blobs_controller_test.rb b/activestorage/test/controllers/blobs_controller_test.rb index 9c811df895..9bf2641de6 100644 --- a/activestorage/test/controllers/blobs_controller_test.rb +++ b/activestorage/test/controllers/blobs_controller_test.rb @@ -20,3 +20,28 @@ class ActiveStorage::BlobsControllerTest < ActionDispatch::IntegrationTest assert_equal "max-age=300, private", @response.headers["Cache-Control"] end end + +if SERVICE_CONFIGURATIONS[:s3] && SERVICE_CONFIGURATIONS[:s3][:access_key_id].present? + class ActiveStorage::S3BlobsControllerTest < ActionDispatch::IntegrationTest + setup do + @old_service = ActiveStorage::Blob.service + ActiveStorage::Blob.service = ActiveStorage::Service.configure(:s3, SERVICE_CONFIGURATIONS) + end + + teardown do + ActiveStorage::Blob.service = @old_service + end + + test "allow redirection to the different host" do + blob = create_file_blob filename: "racecar.jpg" + + assert_nothing_raised { get rails_blob_url(blob) } + assert_response :redirect + assert_no_match @request.host, @response.headers["Location"] + ensure + blob.purge + end + end +else + puts "Skipping S3 redirection tests because no S3 configuration was supplied" +end diff --git a/activestorage/test/controllers/representations_controller_test.rb b/activestorage/test/controllers/representations_controller_test.rb index 2662cc5283..4ae0ff877e 100644 --- a/activestorage/test/controllers/representations_controller_test.rb +++ b/activestorage/test/controllers/representations_controller_test.rb @@ -59,3 +59,33 @@ class ActiveStorage::RepresentationsControllerWithPreviewsTest < ActionDispatch: assert_response :not_found end end + +if SERVICE_CONFIGURATIONS[:s3] && SERVICE_CONFIGURATIONS[:s3][:access_key_id].present? + class ActiveStorage::S3RepresentationsControllerWithVariantsTest < ActionDispatch::IntegrationTest + setup do + @old_service = ActiveStorage::Blob.service + ActiveStorage::Blob.service = ActiveStorage::Service.configure(:s3, SERVICE_CONFIGURATIONS) + end + + teardown do + ActiveStorage::Blob.service = @old_service + end + + test "allow redirection to the different host" do + blob = create_file_blob filename: "racecar.jpg" + + assert_nothing_raised do + get rails_blob_representation_url( + filename: blob.filename, + signed_blob_id: blob.signed_id, + variation_key: ActiveStorage::Variation.encode(resize: "100x100")) + end + assert_response :redirect + assert_no_match @request.host, @response.headers["Location"] + ensure + blob.purge + end + end +else + puts "Skipping S3 redirection tests because no S3 configuration was supplied" +end -- cgit v1.2.3