Forbid the use of `/`/`.` in secrets, and also non-string secrets
Akinori MUSHA
2 changed files with 21 additions and 1 deletions
+ 11
- 1
app/models/agents/data_output_agent.rb
@@ -63,7 +63,17 @@ module Agents |
||
| 63 | 63 |
end |
| 64 | 64 |
|
| 65 | 65 |
def validate_options |
| 66 |
- unless options['secrets'].is_a?(Array) && options['secrets'].length > 0 |
|
| 66 |
+ if options['secrets'].is_a?(Array) && options['secrets'].length > 0 |
|
| 67 |
+ options['secrets'].each do |secret| |
|
| 68 |
+ case secret |
|
| 69 |
+ when %r{[/.]}
|
|
| 70 |
+ errors.add(:base, "secret may not contain a slash or dot") |
|
| 71 |
+ when String |
|
| 72 |
+ else |
|
| 73 |
+ errors.add(:base, "secret must be a string") |
|
| 74 |
+ end |
|
| 75 |
+ end |
|
| 76 |
+ else |
|
| 67 | 77 |
errors.add(:base, "Please specify one or more secrets for 'authenticating' incoming feed requests") |
| 68 | 78 |
end |
| 69 | 79 |
|
+ 10
- 0
spec/models/agents/data_output_agent_spec.rb
@@ -34,8 +34,18 @@ describe Agents::DataOutputAgent do |
||
| 34 | 34 |
expect(agent).not_to be_valid |
| 35 | 35 |
agent.options[:secrets] = "foo" |
| 36 | 36 |
expect(agent).not_to be_valid |
| 37 |
+ agent.options[:secrets] = "foo/bar" |
|
| 38 |
+ expect(agent).not_to be_valid |
|
| 39 |
+ agent.options[:secrets] = "foo.xml" |
|
| 40 |
+ expect(agent).not_to be_valid |
|
| 41 |
+ agent.options[:secrets] = false |
|
| 42 |
+ expect(agent).not_to be_valid |
|
| 37 | 43 |
agent.options[:secrets] = [] |
| 38 | 44 |
expect(agent).not_to be_valid |
| 45 |
+ agent.options[:secrets] = ["foo.xml"] |
|
| 46 |
+ expect(agent).not_to be_valid |
|
| 47 |
+ agent.options[:secrets] = ["hello", true] |
|
| 48 |
+ expect(agent).not_to be_valid |
|
| 39 | 49 |
agent.options[:secrets] = ["hello"] |
| 40 | 50 |
expect(agent).to be_valid |
| 41 | 51 |
agent.options[:secrets] = ["hello", "world"] |