This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch db/8607d in repository https://gitbox.apache.org/repos/asf/allura.git
commit 35ed498ab71353e35fd011e7f3af7055a4d6a4dc Author: Dave Brondsema <[email protected]> AuthorDate: Fri Jun 12 15:31:53 2026 -0400 [#8607] validate links via rest --- ForgeLink/forgelink/link_main.py | 10 +++++++++- ForgeLink/forgelink/tests/functional/test_rest.py | 9 +++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/ForgeLink/forgelink/link_main.py b/ForgeLink/forgelink/link_main.py index a6b79673b..e8ad45e56 100644 --- a/ForgeLink/forgelink/link_main.py +++ b/ForgeLink/forgelink/link_main.py @@ -25,6 +25,8 @@ from tg import app_globals as g from tg import request from formencode import validators as fev +import formencode +from webob import exc # Pyforge-specific imports from allura.app import Application, ConfigOption, SitemapEntry, DefaultAdminController @@ -40,6 +42,8 @@ log = logging.getLogger(__name__) +url_validator = fev.URL(not_empty=True, add_http=True) + class ForgeLinkApp(Application): @@ -58,7 +62,7 @@ class ForgeLinkApp(Application): 'url', str, None, label='External Url', help_text='URL to which you wish to link', - validator=fev.URL(not_empty=True, add_http=True), + validator=url_validator, extra_attrs={'type': 'url', 'required': '', 'placeholder': 'https://example.com'}), ] config_on_install = ['url'] @@ -152,6 +156,10 @@ def link_json(self): def index(self, url='', **kw): if (request.method == 'POST') and (url != ''): require_access(self.app, 'configure') + try: + url = url_validator.to_python(url) + except formencode.Invalid as e: + raise exc.HTTPBadRequest(str(e)) self.app.config.options.url = url return self.link_json() diff --git a/ForgeLink/forgelink/tests/functional/test_rest.py b/ForgeLink/forgelink/tests/functional/test_rest.py index 9747afe28..b6d164001 100644 --- a/ForgeLink/forgelink/tests/functional/test_rest.py +++ b/ForgeLink/forgelink/tests/functional/test_rest.py @@ -48,6 +48,15 @@ def test_rest_link(self): r = self.api_get('/rest/p/test/link') assert r.json['url'] == 'http://yahoo.com' + def test_rest_link_invalid_url(self): + self.api_post('/rest/p/test/link', + url='javascript:alert(1)', status=400) + r = self.api_get('/rest/p/test/link') + assert r.json['url'] is None + + r = self.api_post('/rest/p/test/link', url='google.com') + assert r.json['url'] == 'http://google.com' + def test_rest_link_get_permissions(self): self.app.get('/rest/p/test/link', extra_environ={'username': '*anonymous'}, status=200)
