tenderlove/mechanize — Issue #177: MetaRefresh URI does not get sanitized
Author: joallard
Created: 2011-12-21 00:12:41+00:00
State: open

I have been in the situation where the server will redirect me to an unsanitized URI on a meta-refresh.

in [`/lib/mechanize/page/meta_refresh.rb:40`](https://github.com/tenderlove/mechanize/blob/master/lib/mechanize/page/meta_refresh.rb)

```ruby
class Mechanize::Page::MetaRefresh

def self.parse content, base_uri
return unless content =~ CONTENT_REGEXP

delay, refresh_uri = $1, $3

dest = base_uri
dest += refresh_uri if refresh_uri # Oops!

return delay, dest
end
```

The referenced line will raise `URI::InvalidURIError` if `refresh_uri` contains illegal symbols (such as `<`). I don't quite know where the sanitize should be done though.