From de1e79e722679f7f6bb018452aa045bf22cdca30 Mon Sep 17 00:00:00 2001
From: Helio Cola <helio@tcard.io>
Date: Thu, 24 Aug 2023 09:29:28 -0400
Subject: [PATCH] Improve SVG regexp validation to use \A and \z (#19953)

---
 app/models/navigation_link.rb       |  2 +-
 spec/models/navigation_link_spec.rb | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/app/models/navigation_link.rb b/app/models/navigation_link.rb
index 97f648fe8..0cd47d7fe 100644
--- a/app/models/navigation_link.rb
+++ b/app/models/navigation_link.rb
@@ -1,5 +1,5 @@
 class NavigationLink < ApplicationRecord
-  SVG_REGEXP = /<svg .*>/im
+  SVG_REGEXP = /\A<svg .*>[\s]*\z/im
 
   before_validation :allow_relative_url, if: :url?
   before_save :strip_local_hostname, if: :url?
diff --git a/spec/models/navigation_link_spec.rb b/spec/models/navigation_link_spec.rb
index 356c32db5..652476dd3 100644
--- a/spec/models/navigation_link_spec.rb
+++ b/spec/models/navigation_link_spec.rb
@@ -51,6 +51,18 @@ RSpec.describe NavigationLink do
 
       navigation_link.icon = "<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n.  >"
       expect(navigation_link).to be_valid
+
+      navigation_link.icon = "something...something\n<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n.  >"
+      expect(navigation_link).not_to be_valid
+
+      navigation_link.icon = "<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n.  >\n\n\n\n"
+      expect(navigation_link).to be_valid
+
+      navigation_link.icon = "<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n.  >\n\n\t     \n\n"
+      expect(navigation_link).to be_valid
+
+      navigation_link.icon = "<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n.  >\n\nsomething\n\n"
+      expect(navigation_link).not_to be_valid
     end
 
     context "when validating the URL" do