app/validators/url_validator.rb
# Check URL (invoked in models where "validates ... url: true").
# These are the rules checked by the *server*.  The client does some
# quick sanity checks (see app/projects/new.html.erb), which should not
# forbid anything we'd allow, but we can't trust
# those checks because an attacker can easily bypass client-side checks.
# The URL validation rules are somewhat overly strict, but should serve;
# the idea is to prevent attackers from inserting redirecting URLs
# that can sometimes be used to attack third-party sites via the BadgeApp.
# For example, this does *not* include "?...", or ones with <, and the
# use of %-encoded bytes is restricted.
# We can gradually loosen this if needed.  Note that this pattern is
# more restrictive than the ones we allow in markdown justifications,
# because the BadgeApp doies *not* follow those URLs for further processing.
# This regex is our creation, because we're trying to prevent certain URLs
# that by *spec* are legal.  The first part is an expression of the DNS spec,
# the latter simply limits the character set used in the path.
Check URL (invoked in models where "validates ... url: true").
These are the rules checked by the *server*.  The client does some
quick sanity checks , which should not
forbid anything we'd allow, but we can't trust
those checks because an attacker can easily bypass client-side checks.
The URL validation rules are somewhat overly strict, but should serve;
the idea is to prevent attackers from inserting redirecting URLs
that can sometimes be used to attack third-party sites via the BadgeApp.
For example, this does *not* include "?...", or ones with <, and the
use of %-encoded bytes is restricted.
We can gradually loosen this if needed.  Note that this pattern is
more restrictive than the ones we allow in markdown justifications,
because the BadgeApp doies *not* follow those URLs for further processing.
This regex is our creation, because we're trying to prevent certain URLs
that by *spec* are legal.  The first part is an expression of the DNS spec,
the latter simply limits the character set used in the path.
Check URL ( invoked in models where " validates ... url : true " ) . These are the rules checked by the * server * . The client does some quick sanity checks which should not forbid anything we ' d allow but we can ' t trust those checks because an attacker can easily bypass client - side checks . The URL validation rules are somewhat overly strict but should serve ; the idea is to prevent attackers from inserting redirecting URLs that can sometimes be used to attack third - party sites via the BadgeApp . For example this does * not * include " ? ... " or ones with < and the use of % - encoded bytes is restricted . We can gradually loosen this if needed . Note that this pattern is more restrictive than the ones we allow in markdown justifications because the BadgeApp doies * not * follow those URLs for further processing . This regex is our creation because we ' re trying to prevent certain URLs that by * spec * are legal . The first part is an expression of the DNS spec the latter simply limits the character set used in the path .
def validate_each(record, attribute, value)
    return if url_acceptable?(value)
    record.errors.add attribute, (options[:message] ||
                                  I18n.t('error_messages.url_message'))
  end
def validate_each ( record , attribute , value ) return if url_acceptable? ( value ) record . errors . add attribute , ( options [ :message ] || I18n . t ( 'error_messages.url_message' ) ) end
Check URL (invoked in models where "validates ... url: true").
Check URL ( invoked in models where " validates ... url : true " ) .
record
<not_specific>
attribute
<not_specific>
value
<not_specific>