Skip to content

Commit 3cbad68

Browse files
committed
handle invalid data urls in absolute source filter
simply catch exceptions coming from URI.join like the camo filter does. the truth is that arbitrary input can be mal-formatted, e.g. URI::InvalidURIError: bad URI(is not URI?): "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg'
1 parent 4f1aab0 commit 3cbad68

File tree

2 files changed

+14
-1
lines changed

2 files changed

+14
-1
lines changed

lib/html/pipeline/absolute_source_filter.rb

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,12 @@ def call
2828
else
2929
image_subpage_url
3030
end
31-
element['src'] = URI.join(base, src).to_s
31+
32+
begin
33+
element['src'] = URI.join(base, src).to_s
34+
rescue Exception
35+
next
36+
end
3237
end
3338
doc
3439
end

test/html/pipeline/absolute_source_filter_test.rb

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,12 @@ def test_tells_you_where_context_is_required
5353
end
5454
assert_match 'HTML::Pipeline::AbsoluteSourceFilter', exception.message
5555
end
56+
57+
def test_ignores_data_urls
58+
orig = %(<p><img src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 696 391'%3E%3Crect x='0' y='0' width='696' height='391' fill='%23f2f2f2'%3E%3C/rect%3E%3C/svg%3E"></p>)
59+
result = AbsoluteSourceFilter.call(orig, @options).to_s
60+
61+
expected = %(<p><img src="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%20696%20391'%3E%3Crect%20x='0'%20y='0'%20width='696'%20height='391'%20fill='%23f2f2f2'%3E%3C/rect%3E%3C/svg%3E"></p>)
62+
assert_equal expected, result
63+
end
5664
end

0 commit comments

Comments
 (0)