0.03
No release in over 3 years
Sanitize redirect_to URLs
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
 Dependencies

Development

~> 1.14
~> 10.0
~> 3.0

Runtime

 Project Readme

RedirectSafely

Sanitize return_to-style URLs, including some edge cases that you probably missed.

RedirectSafely is used in production and extracted from Shopify.

Installation

Add these lines to your application's Gemfile:

gem 'redirect_safely', '~> 1.0'

And then execute:

$ bundle

Usage

  • RedirectSafely.safe?(url, options)

    Return true if the URL is considered "safe", false otherwise.

    Parameters:

    • url String (required) - The URL to test

    Options:

    • path_match Regexp (optional) - Match the path portion of the URL against a regexp
    • require_absolute Boolean (optional) - If true, require an absolute URL (domain must be included in whitelist)
    • require_ssl Boolean (optional) - If true, and an absolute URL is provided, require a URL starting with https://
    • whitelist String[] (optional) - Whitelisted domains for checking absolute URLs
    • subdomains String[] (optional) - Whitelisted subdomains for checking absolute URLs. Must start with a leading ..
  • RedirectSafely.make_safe(url, default, options)

    Return url if it's safe, otherwise return default.

    Shares options with safe?, and is roughly equivalent to:

    safe_url = RedirectSafely.safe?(url) ? url : default
  • RedirectSafelyValidator

    If you persist a redirect URL on a model, you can validate that it is safe?:

    class Request
      validates :return_to, redirect_safely: true
    end

    You can pass any options supported by safe? (but not those added by make_safe). In the event that you need more control over the options (ie, dynamically producting a whitelist based on other model attributes), write a custom validate method:

    class Request
      validates :store_url, presence: true
      validate :return_to, presence: true
    
      validate :return_to_is_safe
    
      private
    
      def return_to_is_safe
        errors.add(:return_to, :invalid) unless RedirectSafely.safe?(return_to, whitelist: URI.parse(store_uri).host)
      end
    end