TryGhost/Ghost
1
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-01 23:37:43 +03:00
Code Issues Projects Releases Wiki Activity

🐛 Subscribers: validate urls (#7540)

Browse Source 
no issue

- Ensure URLs submitted via form are sanitized so that we only accept real urls
- Add some tests for the isEmptyOrURL validator
This commit is contained in:
Hannah Wolfe 2016-10-14 15:31:20 +01:00 committed by Katharina Irrgang
parent ea2c3a0a3f
commit 03e4acdb37
2 changed files with 40 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
core/server/apps/subscribers/lib/router.js
View File

@ -7,6 +7,7 @@ var path = require('path'),
// Dirty requires
api = require('../../../api'),
errors = require('../../../errors'),
validator = require('../../../data/validation').validator,
templates = require('../../../controllers/frontend/templates'),
postlookup = require('../../../controllers/frontend/post-lookup'),
setResponseContext = require('../../../controllers/frontend/context');
@ -45,9 +46,13 @@ function honeyPot(req, res, next) {
next();
}
function santizeUrl(url) {
return validator.isEmptyOrURL(url) ? url : '';
}
function handleSource(req, res, next) {
req.body.subscribed_url = req.body.location;
req.body.subscribed_referrer = req.body.referrer;
req.body.subscribed_url = santizeUrl(req.body.location);
req.body.subscribed_referrer = santizeUrl(req.body.referrer);
delete req.body.location;
delete req.body.referrer;

33
core/test/unit/validation_spec.js Normal file
View File

@ -0,0 +1,33 @@
var should = require('should'),
validation = require('../../server/data/validation');
// Validate our customisations
describe('Validation', function () {
it('should export our required functions', function () {
should.exist(validation);
validation.should.have.properties(
['validate', 'validator', 'validateSchema', 'validateSettings', 'validateActiveTheme']
);
validation.validate.should.be.a.Function();
validation.validateSchema.should.be.a.Function();
validation.validateSettings.should.be.a.Function();
validation.validateActiveTheme.should.be.a.Function();
validation.validator.should.have.properties(['empty', 'notContains', 'isTimezone', 'isEmptyOrURL', 'isSlug']);
});
describe('Validator customisations', function () {
var validator = validation.validator;
it('isEmptyOrUrl filters javascript urls', function () {
/*jshint scripturl:true */
validator.isEmptyOrURL('javascript:alert(0)').should.be.false();
/*jshint scripturl:false */
validator.isEmptyOrURL('').should.be.true();
validator.isEmptyOrURL('http://localhost:2368').should.be.true();
});
});
});