Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent whitespace from passing honeypot checks #48

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

anthonymfowler15
Copy link

@anthonymfowler15 anthonymfowler15 commented Apr 23, 2021

Description

When a honeypot field is filled with a newline ("\n"), protect_from_spam does not properly block the request. This is because "\n".blank? returns true.

Related Issue

#47

Motivation and Context

As described in the description, this change will make protect_from_spam more robust and block requests where there are any values in the honeypot fields.

Screenshots (if appropriate):

N/A

Types of changes

  • [x ] Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • [x ] My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING document.

@@ -15,7 +15,7 @@ def honeypot_style_class
end

def protect_from_spam
head :ok if honeypot_fields.any? { |f,l| !params[f].blank? }
head :ok if honeypot_fields.any? { |f,l| !params[f].blank? || params[f].to_s.length > 0 }
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps this could be simplified to the one string value we allow:

Suggested change
head :ok if honeypot_fields.any? { |f,l| !params[f].blank? || params[f].to_s.length > 0 }
head :ok if honeypot_fields.any? { |f, _| params[f].to_s != "" }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants