SECURITY: Don't allow base_uri as embeddable host if none exist

discourse · Sep 30, 2019 · d5c5ca4 · d5c5ca4 · discoursereviewbot · Oct 1, 2019
1 parent 7561044
commit d5c5ca4
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/app/models/embeddable_host.rb b/app/models/embeddable_host.rb
@@ -44,7 +44,7 @@ def self.record_for_url(uri)
 
   def self.url_allowed?(url)
     # Work around IFRAME reload on WebKit where the referer will be set to the Forum URL
-    return true if url&.starts_with?(Discourse.base_url)
+    return true if url&.starts_with?(Discourse.base_url) && EmbeddableHost.exists?
 
     uri = begin
       URI(UrlHelper.escape_uri(url))

diff --git a/spec/models/embeddable_host_spec.rb b/spec/models/embeddable_host_spec.rb
@@ -65,6 +65,10 @@
     end
   end
 
+  it "doesn't allow forum own URL if no hosts exist" do
+    expect(EmbeddableHost.url_allowed?(Discourse.base_url)).to eq(false)
+  end
+
   describe "url_allowed?" do
     fab!(:host) { Fabricate(:embeddable_host) }