closed XSS after the @

mzsanford · Aug 23, 2010 · cffce8e · cffce8e · romac · Sep 21, 2010
1 parent b2b27bc
commit cffce8e
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/lib/regex.rb b/lib/regex.rb
@@ -60,7 +60,7 @@ class Regex
     # Allow @ in a url, but only in the middle. Catch things like http://example.com/@user
     REGEXEN[:valid_url_path_chars] = /(?:
       #{REGEXEN[:wikipedia_disambiguation]}|
-      @[^\/]+\/|
+      @#{REGEXEN[:valid_general_url_path_chars]}+\/|
       [\.\,]?#{REGEXEN[:valid_general_url_path_chars]}
     )/ix
     # Valid end-of-path chracters (so /foo. does not gobble the period).

diff --git a/spec/autolinking_spec.rb b/spec/autolinking_spec.rb
@@ -474,6 +474,14 @@ def original_text; "I like www.foobar.com dudes"; end
         end
       end
 
+      context "with a @ in a URL" do
+        def original_text; 'http://x.xx/@"style="color:pink"onmouseover=alert(1)//'; end
+
+        it "should not allow XSS follwing @" do
+          @autolinked_text.should have_autolinked_url('http://x.xx/')
+        end
+      end
+
     end
 
     describe "Autolink all" do