Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion lib/validate_url.rb
Original file line number Diff line number Diff line change
Expand Up @@ -22,13 +22,21 @@ def validate_each(record, attribute, value)
schemes = [*options.fetch(:schemes)].map(&:to_s)
begin
uri = Addressable::URI.parse(value)
unless uri && uri.host && schemes.include?(uri.scheme) && (!options.fetch(:no_local) || uri.host.include?('.'))
unless uri && uri.host && schemes.include?(uri.scheme) && (!options.fetch(:no_local) || not_localhost?(uri.host))
record.errors.add(attribute, options.fetch(:message), :value => value)
end
rescue Addressable::URI::InvalidURIError
record.errors.add(attribute, options.fetch(:message), :value => value)
end
end

private

def not_localhost?(host)
return false if host == '127.0.0.1'

host.include?('.')
end
end

module ClassMethods
Expand Down
5 changes: 5 additions & 0 deletions spec/validate_url_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,11 @@
@user.should_not be_valid
end

it "should not allow a local ip" do
@user.homepage = "http://127.0.0.1"
@user.should_not be_valid
end

it "should not allow weird urls that get interpreted as local hostnames" do
@user.homepage = "http://http://example.com"
@user.should_not be_valid
Expand Down