discourse/lib/validators/upload_url_validator.rb

class UploadUrlValidator < ActiveModel::EachValidator
  def validate_each(record, attribute, value)
    if value.present?
      uri =
        begin
          URI.parse(value)
        rescue URI::InvalidURIError
        end

      unless uri && Discourse.store.has_been_uploaded?(value)
        record.errors[attribute] << (options[:message] || I18n.t('errors.messages.invalid'))
      end
    end
  end
end
SECURITY: Make sure uploaded_urls have corresponding upload records 2016-07-29 01:54:17 +08:00			`class UploadUrlValidator < ActiveModel::EachValidator`
			`def validate_each(record, attribute, value)`
			`if value.present?`
Remove use of `rescue nil`. * `rescue nil` is a really bad pattern to use in our code base. We should rescue errors that we expect the code to throw and not rescue everything because we're unsure of what errors the code would throw. This would reduce the amount of pain we face when debugging why something isn't working as expexted. I've been bitten countless of times by errors being swallowed as a result during debugging sessions. 2018-03-28 16:20:08 +08:00			`uri =`
			`begin`
			`URI.parse(value)`
			`rescue URI::InvalidURIError`
			`end`
SECURITY: Make sure uploaded_urls have corresponding upload records 2016-07-29 01:54:17 +08:00
FIX: wasn't able to update category's settings 2016-08-10 02:14:49 +08:00			`unless uri && Discourse.store.has_been_uploaded?(value)`
SECURITY: Make sure uploaded_urls have corresponding upload records 2016-07-29 01:54:17 +08:00			`record.errors[attribute] << (options[:message] \|\| I18n.t('errors.messages.invalid'))`
			`end`
			`end`
			`end`
			`end`