diff --git a/app/helpers/url_helper.rb b/app/helpers/url_helper.rb index ccbb618ccaf..da941b06848 100644 --- a/app/helpers/url_helper.rb +++ b/app/helpers/url_helper.rb @@ -1,7 +1,7 @@ module UrlHelper def display_safe_url(url) return "" if url.blank? - return h(url) if url.start_with?("https://") || url.start_with?("http://") - return "https://#{h(url)}" + return h(url) if url.start_with?("https://", "http://") + "https://#{h(url)}" end end diff --git a/test/unit/helpers/url_helper_test.rb b/test/unit/helpers/url_helper_test.rb index 1ec72e82796..5b271675323 100644 --- a/test/unit/helpers/url_helper_test.rb +++ b/test/unit/helpers/url_helper_test.rb @@ -18,13 +18,13 @@ class UrlHelperTest < ActionView::TestCase assert_equal "https://javascript:alert('hello');", display_safe_url("javascript:alert('hello');") end - should "escape html" do + should "escape html" do assert_equal "https://<script>alert('hello');</script>https://www", display_safe_url("https://www") - end + end - should "prepend https if url does not begin with http or https" do + should "prepend https if url does not begin with http or https" do assert_equal "https://www.awesomesite.com/https://javascript:alert('hello');", display_safe_url("www.awesomesite.com/https://javascript:alert('hello');") - end + end should "return empty string if url is nil" do assert_equal "", display_safe_url(nil)