From e6f59af64c7645cae130a92a4b7afd908a84c983 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Mon, 29 Jun 2026 21:25:22 +0200 Subject: Prevent xss by not allowing return_to to point to javascript resources --- app/helpers/application_helper.rb | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'app/helpers') diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 0be66e90..72b76b8e 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -11,4 +11,14 @@ module ApplicationHelper end end end + + def safe_return_to(url) + return events_path if url.blank? + uri = URI.parse(url) + return events_path if uri.host.present? + return events_path unless url.start_with?('/') + url + rescue URI::InvalidURIError + events_path + end end -- cgit v1.3