diff --git a/app/services/authentication/providers/facebook.rb b/app/services/authentication/providers/facebook.rb index 964acb4b3..1d968dc9e 100644 --- a/app/services/authentication/providers/facebook.rb +++ b/app/services/authentication/providers/facebook.rb @@ -6,10 +6,11 @@ module Authentication SETTINGS_URL = "https://www.facebook.com/settings?tab=applications".freeze def new_user_data + image_url = @info.image.gsub("http://", "https://") { name: @info.name, email: @info.email || "", - remote_profile_image_url: @info.image.gsub("http://", "https://"), + remote_profile_image_url: Users::SafeRemoteProfileImageUrl.call(image_url), facebook_username: user_nickname, facebook_created_at: Time.zone.now } diff --git a/app/services/authentication/providers/github.rb b/app/services/authentication/providers/github.rb index 54f193742..82e1d6524 100644 --- a/app/services/authentication/providers/github.rb +++ b/app/services/authentication/providers/github.rb @@ -13,7 +13,7 @@ module Authentication github_created_at: raw_info.created_at, github_username: info.nickname, name: name, - remote_profile_image_url: info.image.to_s + remote_profile_image_url: Users::SafeRemoteProfileImageUrl.call(info.image.to_s) } end diff --git a/app/services/authentication/providers/twitter.rb b/app/services/authentication/providers/twitter.rb index de147296e..4259aa48f 100644 --- a/app/services/authentication/providers/twitter.rb +++ b/app/services/authentication/providers/twitter.rb @@ -11,7 +11,7 @@ module Authentication { email: info.email.to_s, name: name, - remote_profile_image_url: remote_profile_image_url, + remote_profile_image_url: Users::SafeRemoteProfileImageUrl.call(remote_profile_image_url), twitter_created_at: raw_info.created_at, twitter_followers_count: raw_info.followers_count.to_i, twitter_following_count: raw_info.friends_count.to_i, diff --git a/app/services/users/safe_remote_profile_image_url.rb b/app/services/users/safe_remote_profile_image_url.rb new file mode 100644 index 000000000..10308cce2 --- /dev/null +++ b/app/services/users/safe_remote_profile_image_url.rb @@ -0,0 +1,10 @@ +module Users + module SafeRemoteProfileImageUrl + # Basic check for nil and blank URLs, alongside likely incomplete URLs, such as just "image.jpg". + def self.call(url) + return url if url.to_s.start_with?("https") + + Users::ProfileImageGenerator.call + end + end +end diff --git a/spec/services/users/safe_remote_profile_image_url_spec.rb b/spec/services/users/safe_remote_profile_image_url_spec.rb new file mode 100644 index 000000000..cab9b4ab0 --- /dev/null +++ b/spec/services/users/safe_remote_profile_image_url_spec.rb @@ -0,0 +1,20 @@ +require "rails_helper" + +RSpec.describe Users::SafeRemoteProfileImageUrl, type: :service do + it "returns the url if passed for proper URLs" do + url = "https://image.com/image.png" + expect(described_class.call(url)).to eq(url) + end + + it "returns fallback image if passed nil" do + expect(described_class.call(nil)).to start_with("https://emojipedia-us.s3") + end + + it "returns fallback image if passed blank" do + expect(described_class.call("")).to start_with("https://emojipedia-us.s3") + end + + it "returns fallback image if passed non-URL" do + expect(described_class.call("image")).to start_with("https://emojipedia-us.s3") + end +end