maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Improve SVG regexp validation to use \A and \z (#19953)

Browse source
This commit is contained in:
Helio Cola 2023-08-24 09:29:28 -04:00 • committed by GitHub
parent 992ced1908
commit de1e79e722
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/models/navigation_link.rb
View file

@ -1,5 +1,5 @@
class NavigationLink < ApplicationRecord class NavigationLink < ApplicationRecord
SVG_REGEXP = /<svg .*>/im SVG_REGEXP = /\A<svg .*>[\s]*\z/im
before_validation :allow_relative_url, if: :url? before_validation :allow_relative_url, if: :url?
before_save :strip_local_hostname, if: :url? before_save :strip_local_hostname, if: :url?

12
spec/models/navigation_link_spec.rb
View file

@ -51,6 +51,18 @@ RSpec.describe NavigationLink do
navigation_link.icon = "<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n. >" navigation_link.icon = "<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n. >"
expect(navigation_link).to be_valid expect(navigation_link).to be_valid
navigation_link.icon = "something...something\n<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n. >"
expect(navigation_link).not_to be_valid
navigation_link.icon = "<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n. >\n\n\n\n"
expect(navigation_link).to be_valid
navigation_link.icon = "<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n. >\n\n\t \n\n"
expect(navigation_link).to be_valid
navigation_link.icon = "<svg foo='bar'\nbaz='lol'\n\n more stuff...\n\n. >\n\nsomething\n\n"
expect(navigation_link).not_to be_valid
end end
context "when validating the URL" do context "when validating the URL" do