diff options
author | Francisco Javier López <fjlopez@gitlab.com> | 2018-06-01 14:43:53 +0300 |
---|---|---|
committer | Douwe Maan <douwe@gitlab.com> | 2018-06-01 14:43:53 +0300 |
commit | 840f80d48b7d8363f171f6137cd9f1fbafb52bfc (patch) | |
tree | 612c6f9b846f9f2f3b44931db12557024c49ef66 /spec/support/shared_examples/url_validator_examples.rb | |
parent | e206e32881e4fbfcbe647d7b2ee713c99ef1bf99 (diff) |
Add validation to webhook and service URLs to ensure they are not blocked because of SSRF
Diffstat (limited to 'spec/support/shared_examples/url_validator_examples.rb')
-rw-r--r-- | spec/support/shared_examples/url_validator_examples.rb | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/spec/support/shared_examples/url_validator_examples.rb b/spec/support/shared_examples/url_validator_examples.rb new file mode 100644 index 00000000000..b4757a70984 --- /dev/null +++ b/spec/support/shared_examples/url_validator_examples.rb @@ -0,0 +1,42 @@ +RSpec.shared_examples 'url validator examples' do |protocols| + let(:validator) { described_class.new(attributes: [:link_url], **options) } + let!(:badge) { build(:badge, link_url: 'http://www.example.com') } + + subject { validator.validate_each(badge, :link_url, badge.link_url) } + + describe '#validates_each' do + context 'with no options' do + let(:options) { {} } + + it "allows #{protocols.join(',')} protocols by default" do + expect(validator.send(:default_options)[:protocols]).to eq protocols + end + + it 'checks that the url structure is valid' do + badge.link_url = "#{badge.link_url}:invalid_port" + + subject + + expect(badge.errors.empty?).to be false + end + end + + context 'with protocols' do + let(:options) { { protocols: %w[http] } } + + it 'allows urls with the defined protocols' do + subject + + expect(badge.errors.empty?).to be true + end + + it 'add error if the url protocol does not match the selected ones' do + badge.link_url = 'https://www.example.com' + + subject + + expect(badge.errors.empty?).to be false + end + end + end +end |