From cb292a464cfdec610d50985784fc92533fc10de5 Mon Sep 17 00:00:00 2001
From: Joshua Wehner <joshua@forem.com>
Date: Wed, 21 Dec 2022 15:32:31 +0100
Subject: [PATCH] Try sanitizing user-agent during embed validation (#18857)

---
 app/liquid_tags/unified_embed/tag.rb       | 6 +++++-
 spec/liquid_tags/unified_embed/tag_spec.rb | 6 ++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/app/liquid_tags/unified_embed/tag.rb b/app/liquid_tags/unified_embed/tag.rb
index 164a9676d..e08216280 100644
--- a/app/liquid_tags/unified_embed/tag.rb
+++ b/app/liquid_tags/unified_embed/tag.rb
@@ -48,7 +48,7 @@ module UnifiedEmbed
       http.use_ssl = true if http.port == 443
 
       req = method.new(uri.request_uri)
-      req["User-Agent"] = "#{Settings::Community.community_name} (#{URL.url})"
+      req["User-Agent"] = "#{safe_user_agent} (#{URL.url})"
       response = http.request(req)
 
       case response
@@ -76,6 +76,10 @@ module UnifiedEmbed
 
       raise StandardError, I18n.t("liquid_tags.unified_embed.tag.listings_disabled")
     end
+
+    def self.safe_user_agent(agent = Settings::Community.community_name)
+      agent.gsub(/[^-_.()a-zA-Z0-9 ]+/, "-")
+    end
   end
 end
 
diff --git a/spec/liquid_tags/unified_embed/tag_spec.rb b/spec/liquid_tags/unified_embed/tag_spec.rb
index 2238da9fd..60fd7d05e 100644
--- a/spec/liquid_tags/unified_embed/tag_spec.rb
+++ b/spec/liquid_tags/unified_embed/tag_spec.rb
@@ -144,4 +144,10 @@ RSpec.describe UnifiedEmbed::Tag, type: :liquid_tag do
       Liquid::Template.parse("{% embed #{listing_url} %}")
     end.to raise_error(StandardError, "Listings are disabled on this Forem; cannot embed a listing URL")
   end
+
+  it "sanitizes community_name into safe user-agent string" do
+    unsafe = "Some of this.is_not_safe (but that's okay?) 🌱"
+    result = described_class.safe_user_agent(unsafe)
+    expect(result).to eq("Some of this.is_not_safe (but that-s okay-) -")
+  end
 end