ruby 使用Rails和Ruby重定向“安全”。

Posted 2021-05-16

def clean_for_action_based_url(url)
  CGI.unescape(url || "").
    gsub(/\/+/, "/").
    tr('^a-z_-/', "")
end

def clean_url(url)
  url = CGI.unescape(url || "")
  url = url.gsub(/\A((https?:)?\/+)*/, "").gsub(/\/+/, "/")
  url.split("/").map { |v| CGI.escape(v) }.
    join("/").prepend("/")
end

redirect_to clean_url(params[:next]) # Without Rails
redirect_to root_path(params[:next], 
  only_path: true
) # Rails