Whitelist the parameters for pages based on which page/layouts are actually present

just3ws · just3ws · commit 7136fcd366f8 · 2014-05-19T14:50:39.000-05:00
diff --git a/app/controllers/pages_controller.rb b/app/controllers/pages_controller.rb
@@ -1,6 +1,27 @@
 class PagesController < ApplicationController
+
+
   def show
     show_pages_params = params.permit(:page, :layout)
-    render action: show_pages_params[:page], layout: (show_pages_params[:layout] || 'application')
+    page_to_show = whitelist_page(show_pages_params[:page])
+
+    render action: page_to_show, layout: whitelist_layout(show_pages_params[:layout])
+  end
+
+  private
+
+  # Checks whether the requested_page exists in app/views/pages/*.html.haml
+  def whitelist_page(requested_page)
+    raise "Invalid page: #{requested_page}" unless STATIC_PAGES.include?(requested_page)
+
+    requested_page
+  end
+
+  def whitelist_layout(requested_layout)
+    return 'application' if requested_layout.nil?
+
+    raise "Invalid layout: #{requested_layout}" unless STATIC_PAGE_LAYOUTS.include?(requested_layout)
+
+    requested_layout
   end
 end
diff --git a/config/initializers/pages.rb b/config/initializers/pages.rb
@@ -0,0 +1,15 @@
+# Look at the *.html.haml files in the app/views/pages directory
+STATIC_PAGES ||= Dir.glob('app/views/pages/*.html.{erb,haml}')
+  .map { |f| File.basename(f, '.html.erb') }
+  .map { |f| File.basename(f, '.html.haml') }
+  .reject{ |f| f =~ /^_/ }
+  .sort
+  .uniq
+
+# Look at the *.html.haml files in the app/views/pages directory
+STATIC_PAGE_LAYOUTS ||= Dir.glob('app/views/layouts/*.html.{erb,haml}')
+  .map { |f| File.basename(f, '.html.erb') }
+  .map { |f| File.basename(f, '.html.haml') }
+  .reject{ |f| f =~ /^_/ }
+  .sort
+  .uniq
diff --git a/spec/controllers/pages_controller_spec.rb b/spec/controllers/pages_controller_spec.rb
@@ -1,12 +1,24 @@
 require 'spec_helper'
 
 describe PagesController do
-
   it 'should be able to access privacy policy while user is logged in but not registered' do
     unregisterd_user = Fabricate(:user, state: User::REGISTRATION)
     controller.send :sign_in, unregisterd_user
-    get :show, page: 'tos'
+    get :show, page: 'tos', layout: 'application'
     response.should be_success
   end
 
-end
+  it 'fails when presented an non-whitelisted page' do
+    unregisterd_user = Fabricate(:user, state: User::REGISTRATION)
+    controller.send :sign_in, unregisterd_user
+
+    expect { get :show, page: 'IMNOTREAL' }.to raise_error 'Invalid page: IMNOTREAL'
+  end
+
+  it 'fails when presented an non-whitelisted layout' do
+    unregisterd_user = Fabricate(:user, state: User::REGISTRATION)
+    controller.send :sign_in, unregisterd_user
+
+    expect { get :show, page: 'tos', layout: 'IMNOTREAL' }.to raise_error 'Invalid layout: IMNOTREAL'
+  end
+end
