Try sanitizing user-agent during embed validation (#18857)

app/liquid_tags/unified_embed/tag.rb

@@ -48,7 +48,7 @@ module UnifiedEmbed
       http.use_ssl = true if http.port == 443
 
       req = method.new(uri.request_uri)
-      req["User-Agent"] = "#{Settings::Community.community_name} (#{URL.url})"
+      req["User-Agent"] = "#{safe_user_agent} (#{URL.url})"
       response = http.request(req)
 
       case response
@@ -76,6 +76,10 @@ module UnifiedEmbed
 
       raise StandardError, I18n.t("liquid_tags.unified_embed.tag.listings_disabled")
     end
+
+    def self.safe_user_agent(agent = Settings::Community.community_name)
+      agent.gsub(/[^-_.()a-zA-Z0-9 ]+/, "-")
+    end
   end
 end
 

spec/liquid_tags/unified_embed/tag_spec.rb

@@ -144,4 +144,10 @@ RSpec.describe UnifiedEmbed::Tag, type: :liquid_tag do
       Liquid::Template.parse("{% embed #{listing_url} %}")
     end.to raise_error(StandardError, "Listings are disabled on this Forem; cannot embed a listing URL")
   end
+
+  it "sanitizes community_name into safe user-agent string" do
+    unsafe = "Some of this.is_not_safe (but that's okay?) 🌱"
+    result = described_class.safe_user_agent(unsafe)
+    expect(result).to eq("Some of this.is_not_safe (but that-s okay-) -")
+  end
 end