Try sanitizing user-agent during embed validation (forem#18857)

viet-dev · Dec 21, 2022 · cb292a4 · cb292a4
1 parent c410109
commit cb292a4
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/app/liquid_tags/unified_embed/tag.rb b/app/liquid_tags/unified_embed/tag.rb
@@ -48,7 +48,7 @@ def self.validate_link(input:, retries: MAX_REDIRECTION_COUNT, method: Net::HTTP
       http.use_ssl = true if http.port == 443
 
       req = method.new(uri.request_uri)
-      req["User-Agent"] = "#{Settings::Community.community_name} (#{URL.url})"
+      req["User-Agent"] = "#{safe_user_agent} (#{URL.url})"
       response = http.request(req)
 
       case response
@@ -76,6 +76,10 @@ def self.handle_listings_disabled!(link)
 
       raise StandardError, I18n.t("liquid_tags.unified_embed.tag.listings_disabled")
     end
+
+    def self.safe_user_agent(agent = Settings::Community.community_name)
+      agent.gsub(/[^-_.()a-zA-Z0-9 ]+/, "-")
+    end
   end
 end
 

diff --git a/spec/liquid_tags/unified_embed/tag_spec.rb b/spec/liquid_tags/unified_embed/tag_spec.rb
@@ -144,4 +144,10 @@
       Liquid::Template.parse("{% embed #{listing_url} %}")
     end.to raise_error(StandardError, "Listings are disabled on this Forem; cannot embed a listing URL")
   end
+
+  it "sanitizes community_name into safe user-agent string" do
+    unsafe = "Some of this.is_not_safe (but that's okay?) 🌱"
+    result = described_class.safe_user_agent(unsafe)
+    expect(result).to eq("Some of this.is_not_safe (but that-s okay-) -")
+  end
 end