Prevent xss by not allowing return_to to point to javascript resources

1 files changed, 10 insertions, 0 deletions

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 0be66e9..72b76b8 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -11,4 +11,14 @@ module ApplicationHelper
       end
     end
   end
+
+  def safe_return_to(url)
+    return events_path if url.blank?
+    uri = URI.parse(url)
+    return events_path if uri.host.present?
+    return events_path unless url.start_with?('/')
+    url
+  rescue URI::InvalidURIError
+    events_path
+  end
 end