buggood first issue
Métriques du dépôt
- Stars
- (4 680 étoiles)
- Métriques de merge PR
- (Merge moyen 7j 4h) (20 PRs mergées en 30 j)
Description
Here's a test case for a bug that makes it possible to circumvent the normal validation about blanking comments. In prod we saw this bug abused with \u200b (zero-width joiner) and \u3000 (CJK ideographic space). There are almost certainly more like this, so checking against the unicode character class seems the best approach to prevent blank comments.
diff --git spec/models/comment_spec.rb spec/models/comment_spec.rb
index 34af4d2..12c0f27 100644
--- spec/models/comment_spec.rb
+++ spec/models/comment_spec.rb
@@ -37,4 +37,10 @@
comment = build(:comment, markeddown_comment: "a" * 16_777_216)
expect(comment).to_not be_valid
end
+
+ it "doesn't permit blank comments" do
+ comment = build(:comment, comment: "\t\u200b\u3000")
+ comment.valid?
+ expect(comment.errors[:comment]).to eq(['cannot be blank.'])
+ end
end