From 5a9fdd4e01dbe68bc1baa38acc9b9eafce3e96ad Mon Sep 17 00:00:00 2001 From: Michael Kohl Date: Thu, 30 Sep 2021 10:43:23 +0700 Subject: [PATCH] Fix search param cache leak (#14848) --- app/controllers/stories/articles_search_controller.rb | 2 -- config/fastly/snippets/safe_params_list.vcl | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/app/controllers/stories/articles_search_controller.rb b/app/controllers/stories/articles_search_controller.rb index 0a2291ca4..7caed60c1 100644 --- a/app/controllers/stories/articles_search_controller.rb +++ b/app/controllers/stories/articles_search_controller.rb @@ -1,7 +1,5 @@ module Stories class ArticlesSearchController < ApplicationController - before_action :set_cache_control_headers, only: :index - rescue_from ArgumentError, with: :bad_request def index diff --git a/config/fastly/snippets/safe_params_list.vcl b/config/fastly/snippets/safe_params_list.vcl index 0170e8f47..80fc88337 100644 --- a/config/fastly/snippets/safe_params_list.vcl +++ b/config/fastly/snippets/safe_params_list.vcl @@ -2,6 +2,6 @@ import querystring; sub vcl_recv { # return this URL with only the parameters that match this regular expression if (req.url !~ "/admin/" && req.url !~ "/search/" && req.url !~ "/bulk_show") { - set req.url = querystring.regfilter_except(req.url, "^(a_id|args|article_id|article_ids|articles|asc|callback_url|category|chat_channel_id|client_id|code|collection_id|commentable_id|commentable_type|confirmation_token|created_at|end|email|filter|followable_id|followable_type|forem_owner_secret|fork_id|i|key|message_offset|name|oauth_token|oauth_verifier|offset|onboarding|org_id|organization_id|p|page|per_page|p_id|prefill|preview|purchaser|reactable_ids|redirect_uri|reported_url|reporter_username|response_type|scope|search|signature|sort|source_id|source_type|start|state|status|tag|tag_list|top|type_of|url|username|invitation_token|reset_password_token|ut|verb|invitation_slug)$"); + set req.url = querystring.regfilter_except(req.url, "^(a_id|args|article_id|article_ids|articles|asc|callback_url|category|chat_channel_id|client_id|code|collection_id|commentable_id|commentable_type|confirmation_token|created_at|end|email|filter|followable_id|followable_type|forem_owner_secret|fork_id|i|key|message_offset|name|oauth_token|oauth_verifier|offset|onboarding|org_id|organization_id|p|page|per_page|p_id|prefill|preview|purchaser|q|reactable_ids|redirect_uri|reported_url|reporter_username|response_type|scope|search|signature|sort|source_id|source_type|start|state|status|tag|tag_list|top|type_of|url|username|invitation_token|reset_password_token|ut|verb|invitation_slug)$"); } }