Skip to content

Commit 61b0a68

Browse files
committed
Handle bad URIs when filtering redirects
rails#51131 introduced parameter filtering for redirects. We didn't account for invalid URIs though, and it changes the behaviour of redirect_to to raise URI errors when we try to filter a bad URI. Instead, we should fallback to filtering bad URIs entirely to preserve behaviour.
1 parent 3c6adf2 commit 61b0a68

File tree

2 files changed

+16
-0
lines changed

2 files changed

+16
-0
lines changed

actionpack/lib/action_dispatch/http/filter_redirect.rb

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ def parameter_filtered_location
4242
end
4343
end
4444
uri.to_s
45+
rescue URI::Error
46+
FILTERED
4547
end
4648
end
4749
end

actionpack/test/controller/log_subscriber_test.rb

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ def filterable_redirector_with_params
3636
redirect_to "http://secret.foo.bar?username=repinel&password=1234"
3737
end
3838

39+
def filterable_redirector_bad_uri
40+
redirect_to " s:/invalid-string0uri"
41+
end
42+
3943
def data_sender
4044
send_data "cool data", filename: "file.txt"
4145
end
@@ -296,6 +300,16 @@ def test_filter_redirect_params_by_regexp
296300
assert_equal "Redirected to http://secret.foo.bar?username=repinel&password=[FILTERED]", logs[1]
297301
end
298302

303+
def test_filter_redirect_bad_uri
304+
@request.env["action_dispatch.parameter_filter"] = [/pass.+/]
305+
306+
get :filterable_redirector_bad_uri
307+
wait
308+
309+
assert_equal 3, logs.size
310+
assert_equal "Redirected to [FILTERED]", logs[1]
311+
end
312+
299313
def test_send_data
300314
get :data_sender
301315
wait

0 commit comments

Comments
 (0)