Skip to content

Commit 26e3166

Browse files
committed
Merge pull request gjtorikian#101 from jch/camo-uri-encoding
Don't URI parse src before passing to camo
2 parents 8307b18 + 8cf7cb1 commit 26e3166

File tree

2 files changed

+13
-19
lines changed

2 files changed

+13
-19
lines changed

lib/html/pipeline/camo_filter.rb

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,19 +25,20 @@ def call
2525
return unless asset_proxy_enabled?
2626

2727
doc.search("img").each do |element|
28-
next if element['src'].nil?
28+
original_src = element['src']
29+
next unless original_src
2930

3031
begin
31-
uri = URI.parse(element['src'])
32+
uri = URI.parse(original_src)
3233
rescue Exception
3334
next
3435
end
3536

3637
next if uri.host.nil?
3738
next if asset_host_whitelisted?(uri.host)
3839

39-
element['src'] = asset_proxy_url(uri.to_s)
40-
element['data-canonical-src'] = uri.to_s
40+
element['src'] = asset_proxy_url(original_src)
41+
element['data-canonical-src'] = original_src
4142
end
4243
doc
4344
end

test/html/pipeline/camo_filter_test.rb

Lines changed: 8 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,51 +15,44 @@ def setup
1515

1616
def test_camouflaging_http_image_urls
1717
orig = %(<p><img src="http://twitter.com/img.png"></p>)
18-
assert_includes 'img src="' + @asset_proxy_url,
19-
CamoFilter.call(orig, @options).to_s
20-
assert_includes 'data-canonical-src="http://twitter.com/img.png"',
18+
assert_equal %(<p><img src="https//assets.example.org/a5ad43494e343b20d745586282be61ff530e6fa0/687474703a2f2f747769747465722e636f6d2f696d672e706e67" data-canonical-src="http://twitter.com/img.png"></p>),
2119
CamoFilter.call(orig, @options).to_s
2220
end
2321

2422
def test_doesnt_rewrite_dotcom_image_urls
2523
orig = %(<p><img src="https://github.com/img.png"></p>)
26-
assert_equal "<p><img src=\"https://github.com/img.png\"></p>",
27-
CamoFilter.call(orig, @options).to_s
24+
assert_equal orig, CamoFilter.call(orig, @options).to_s
2825
end
2926

3027
def test_doesnt_rewrite_dotcom_subdomain_image_urls
3128
orig = %(<p><img src="https://raw.github.com/img.png"></p>)
32-
assert_equal "<p><img src=\"https://raw.github.com/img.png\"></p>",
33-
CamoFilter.call(orig, @options).to_s
29+
assert_equal orig, CamoFilter.call(orig, @options).to_s
3430
end
3531

3632
def test_doesnt_rewrite_dotcom_subsubdomain_image_urls
3733
orig = %(<p><img src="https://f.assets.github.com/img.png"></p>)
38-
assert_equal "<p><img src=\"https://f.assets.github.com/img.png\"></p>",
39-
CamoFilter.call(orig, @options).to_s
34+
assert_equal orig, CamoFilter.call(orig, @options).to_s
4035
end
4136

4237
def test_camouflaging_github_prefixed_image_urls
4338
orig = %(<p><img src="https://notgithub.com/img.png"></p>)
44-
assert_includes 'img src="' + @asset_proxy_url,
39+
assert_equal %(<p><img src="https//assets.example.org/5d4a96c69713f850520538e04cb9661035cfb534/68747470733a2f2f6e6f746769746875622e636f6d2f696d672e706e67" data-canonical-src="https://notgithub.com/img.png"></p>),
4540
CamoFilter.call(orig, @options).to_s
4641
end
4742

4843
def test_doesnt_rewrite_absolute_image_urls
4944
orig = %(<p><img src="/img.png"></p>)
50-
assert_equal "<p><img src=\"/img.png\"></p>",
51-
CamoFilter.call(orig, @options).to_s
45+
assert_equal orig, CamoFilter.call(orig, @options).to_s
5246
end
5347

5448
def test_doesnt_rewrite_relative_image_urls
5549
orig = %(<p><img src="img.png"></p>)
56-
assert_equal "<p><img src=\"img.png\"></p>",
57-
CamoFilter.call(orig, @options).to_s
50+
assert_equal orig, CamoFilter.call(orig, @options).to_s
5851
end
5952

6053
def test_camouflaging_https_image_urls
6154
orig = %(<p><img src="https://foo.com/img.png"></p>)
62-
assert_includes 'img src="' + @asset_proxy_url,
55+
assert_equal %(<p><img src="https//assets.example.org/3c5c6dc74fd6592d2596209dfcb8b7e5461383c8/68747470733a2f2f666f6f2e636f6d2f696d672e706e67" data-canonical-src="https://foo.com/img.png"></p>),
6356
CamoFilter.call(orig, @options).to_s
6457
end
6558

0 commit comments

Comments
 (0)