50bdfd5488
In theory it's possible to add a `host` parameter to a URL, and we could end up redirecting to that host if we just redirect using query parameters. Generating the path using `url_for` with `only_path` solves the issue. Note in the tests I'm using the `get` method because the `patch` method wouldn't send query parameters. This doesn't mean the action can be accessed through GET requests, since controller tests don't check route verbs. Using feature specs doesn't seem to work because `controller` and `host` parameters are filtered automatically in feature specs. Also note I'm not testing every hidden/moderation controller because they basically use the same code.
26 lines
750 B
Ruby
26 lines
750 B
Ruby
require "rails_helper"
|
|
|
|
describe Admin::OrganizationsController do
|
|
before { sign_in create(:administrator).user }
|
|
|
|
describe "PUT verify" do
|
|
it "keeps query parameters while using protected redirects" do
|
|
organization = create(:organization)
|
|
|
|
get :verify, params: { id: organization, filter: "pending", host: "evil.dev" }
|
|
|
|
expect(response).to redirect_to "/admin/organizations?filter=pending"
|
|
end
|
|
end
|
|
|
|
describe "PUT reject" do
|
|
it "keeps query parameters while using protected redirects" do
|
|
organization = create(:organization)
|
|
|
|
get :reject, params: { id: organization, filter: "pending", host: "evil.dev" }
|
|
|
|
expect(response).to redirect_to "/admin/organizations?filter=pending"
|
|
end
|
|
end
|
|
end
|