Skip to content

Commit

Permalink
Handle bad URIs when filtering redirects
Browse files Browse the repository at this point in the history
rails#51131 introduced parameter filtering for redirects. We
didn't account for invalid URIs though, and it changes the behaviour of
redirect_to to raise URI errors when we try to filter a bad URI.
Instead, we should fallback to filtering bad URIs entirely to preserve behaviour.
  • Loading branch information
gmcgibbon authored and gabriel-amaral committed Feb 29, 2024
1 parent d8a9be8 commit 053470a
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 0 deletions.
2 changes: 2 additions & 0 deletions actionpack/lib/action_dispatch/http/filter_redirect.rb
Expand Up @@ -42,6 +42,8 @@ def parameter_filtered_location
end
end
uri.to_s
rescue URI::Error
FILTERED
end
end
end
Expand Down
14 changes: 14 additions & 0 deletions actionpack/test/controller/log_subscriber_test.rb
Expand Up @@ -36,6 +36,10 @@ def filterable_redirector_with_params
redirect_to "http://secret.foo.bar?username=repinel&password=1234"
end

def filterable_redirector_bad_uri
redirect_to " s:/invalid-string0uri"
end

def data_sender
send_data "cool data", filename: "file.txt"
end
Expand Down Expand Up @@ -296,6 +300,16 @@ def test_filter_redirect_params_by_regexp
assert_equal "Redirected to http://secret.foo.bar?username=repinel&password=[FILTERED]", logs[1]
end

def test_filter_redirect_bad_uri
@request.env["action_dispatch.parameter_filter"] = [/pass.+/]

get :filterable_redirector_bad_uri
wait

assert_equal 3, logs.size
assert_equal "Redirected to [FILTERED]", logs[1]
end

def test_send_data
get :data_sender
wait
Expand Down

0 comments on commit 053470a

Please sign in to comment.