forked from OpenNeo/impress
Emi Matchu
38bad12778
Before this change, the "Ornamental Lake with Goldies" item would fail to preview on the item page: the iframe for the animation layer would display an error page. The error was: ``` Invalid Content Security Policy script-src: "https://images.neopets.com/cp/items/data/000/000/497/497366_deca9f2827/497366_HTML5 Canvas.js". Directive values must not contain whitespace or semicolons. Please use multiple arguments or other directive methods instead. (ActionDispatch::ContentSecurityPolicy::InvalidDirectiveError) ``` This is because the URL that Neopets sends us for this JS file contains an unescaped space character. This isn't usually an issue for e.g. loading a URL in the browser, but it's *not* valid syntax for inclusion in a Content Security Policy. In this change, we update our CSP code to parse URLs into `Addressable::URI` objects, which enables us to call the `normalize!` method, which fixes oddities like that. The URL now correctly appears in the CSP as `https://images.neopets.com/cp/items/data/000/000/497/497366_deca9f2827/497366_HTML5%20Canvas.js`. |
||
|---|---|---|
| .. | ||
| devise | ||
| fundraising | ||
| about_controller.rb | ||
| alt_styles_controller.rb | ||
| application_controller.rb | ||
| auth_users_controller.rb | ||
| closet_hangers_controller.rb | ||
| closet_lists_controller.rb | ||
| contributions_controller.rb | ||
| item_appearances_controller.rb | ||
| item_trades_controller.rb | ||
| items_controller.rb | ||
| locales_controller.rb | ||
| neopass_connections_controller.rb | ||
| neopets_connections_controller.rb | ||
| neopets_page_import_tasks_controller.rb | ||
| outfits_controller.rb | ||
| pet_states_controller.rb | ||
| pet_types_controller.rb | ||
| pets_controller.rb | ||
| sitemap_controller.rb | ||
| swf_assets_controller.rb | ||
| users_controller.rb | ||