diff options
author | JoramWilander <jwawilander@gmail.com> | 2015-10-30 13:36:51 -0400 |
---|---|---|
committer | JoramWilander <jwawilander@gmail.com> | 2015-11-02 10:38:13 -0500 |
commit | 1f3423796eee06a126d3cab7c276e2d0f169b869 (patch) | |
tree | 06b8617093b32c0c85347a170fe3ebb18f5b992a /model | |
parent | 9d34e95045e5e0ff1281fd1eb2e5b20b7bf6ac8f (diff) | |
download | chat-1f3423796eee06a126d3cab7c276e2d0f169b869.tar.gz chat-1f3423796eee06a126d3cab7c276e2d0f169b869.tar.bz2 chat-1f3423796eee06a126d3cab7c276e2d0f169b869.zip |
Validate callback urls on the server and add help text to outgoing webhooks
Diffstat (limited to 'model')
-rw-r--r-- | model/outgoing_webhook.go | 6 | ||||
-rw-r--r-- | model/outgoing_webhook_test.go | 5 | ||||
-rw-r--r-- | model/utils.go | 13 |
3 files changed, 24 insertions, 0 deletions
diff --git a/model/outgoing_webhook.go b/model/outgoing_webhook.go index 8958dd5b0..9a1b89a85 100644 --- a/model/outgoing_webhook.go +++ b/model/outgoing_webhook.go @@ -100,6 +100,12 @@ func (o *OutgoingWebhook) IsValid() *AppError { return NewAppError("OutgoingWebhook.IsValid", "Invalid callback urls", "") } + for _, callback := range o.CallbackURLs { + if !IsValidHttpUrl(callback) { + return NewAppError("OutgoingWebhook.IsValid", "Invalid callback URLs. Each must be a valid URL and start with http:// or https://", "") + } + } + return nil } diff --git a/model/outgoing_webhook_test.go b/model/outgoing_webhook_test.go index 2ca48c291..0d1cd773e 100644 --- a/model/outgoing_webhook_test.go +++ b/model/outgoing_webhook_test.go @@ -80,6 +80,11 @@ func TestOutgoingWebhookIsValid(t *testing.T) { t.Fatal("should be invalid") } + o.CallbackURLs = []string{"nowhere.com/"} + if err := o.IsValid(); err == nil { + t.Fatal("should be invalid") + } + o.CallbackURLs = []string{"http://nowhere.com/"} if err := o.IsValid(); err != nil { t.Fatal(err) diff --git a/model/utils.go b/model/utils.go index bb0669df7..681ade870 100644 --- a/model/utils.go +++ b/model/utils.go @@ -11,6 +11,7 @@ import ( "fmt" "io" "net/mail" + "net/url" "regexp" "strings" "time" @@ -301,3 +302,15 @@ var UrlRegex = regexp.MustCompile(`^((?:[a-z]+:\/\/)?(?:(?:[a-z0-9\-]+\.)+(?:[a- var PartialUrlRegex = regexp.MustCompile(`/([A-Za-z0-9]{26})/([A-Za-z0-9]{26})/((?:[A-Za-z0-9]{26})?.+(?:\.[A-Za-z0-9]{3,})?)`) var SplitRunes = map[rune]bool{',': true, ' ': true, '.': true, '!': true, '?': true, ':': true, ';': true, '\n': true, '<': true, '>': true, '(': true, ')': true, '{': true, '}': true, '[': true, ']': true, '+': true, '/': true, '\\': true} + +func IsValidHttpUrl(rawUrl string) bool { + if strings.Index(rawUrl, "http://") != 0 && strings.Index(rawUrl, "https://") != 0 { + return false + } + + if _, err := url.ParseRequestURI(rawUrl); err != nil { + return false + } + + return true +} |