diff options
Diffstat (limited to 'spec/validators/addressable_url_validator_spec.rb')
-rw-r--r-- | spec/validators/addressable_url_validator_spec.rb | 70 |
1 files changed, 68 insertions, 2 deletions
diff --git a/spec/validators/addressable_url_validator_spec.rb b/spec/validators/addressable_url_validator_spec.rb index 9109a899881..c95c0563a55 100644 --- a/spec/validators/addressable_url_validator_spec.rb +++ b/spec/validators/addressable_url_validator_spec.rb @@ -49,10 +49,15 @@ RSpec.describe AddressableUrlValidator do end end - it 'provides all arguments to UrlBlock validate' do + it 'provides all arguments to UrlBlocker.validate!' do + # AddressableUrlValidator evaluates all procs before passing as arguments. + expected_opts = described_class::BLOCKER_VALIDATE_OPTIONS.transform_values do |value| + value.is_a?(Proc) ? value.call : value + end + expect(Gitlab::UrlBlocker) .to receive(:validate!) - .with(badge.link_url, described_class::BLOCKER_VALIDATE_OPTIONS) + .with(badge.link_url, expected_opts) .and_return(true) subject @@ -302,6 +307,67 @@ RSpec.describe AddressableUrlValidator do end end + context 'when deny_all_requests_except_allowed is' do + let(:url) { 'http://example.com' } + let(:options) { { attributes: [:link_url] } } + let(:validator) { described_class.new(**options) } + + context 'true' do + let(:options) { super().merge(deny_all_requests_except_allowed: true) } + + it 'prevents the url' do + badge.link_url = url + + subject + + expect(badge.errors).to be_present + end + end + + context 'false' do + let(:options) { super().merge(deny_all_requests_except_allowed: false) } + + it 'allows the url' do + badge.link_url = url + + subject + + expect(badge.errors).to be_empty + end + end + + context 'not given' do + before do + allow(Gitlab::CurrentSettings).to receive(:current_application_settings?).and_return(true) + stub_application_setting(deny_all_requests_except_allowed: app_setting) + end + + context 'when app setting is true' do + let(:app_setting) { true } + + it 'prevents the url' do + badge.link_url = url + + subject + + expect(badge.errors).to be_present + end + end + + context 'when app setting is false' do + let(:app_setting) { false } + + it 'allows the url' do + badge.link_url = url + + subject + + expect(badge.errors).to be_empty + end + end + end + end + context 'when enforce_sanitization is' do let(:validator) { described_class.new(attributes: [:link_url], enforce_sanitization: enforce_sanitization) } let(:unsafe_url) { "https://replaceme.com/'><script>alert(document.cookie)</script>" } |