franckverrot/activevalidators — pull request #45 by lwe (2012-07-18 12:35:29+00:00)
Title: Regexp fixes: ensure to use \A and \z instead of ^ and $

After noticing that `URI.regexp` returns a regular expression with ^ and $, I've decided to ensure that the UrlValidator works correctly so that injecting content is not possible. The primary problem ist that ^ and $ match beginning and end of line, instead of beginning and end of input, so well placed newline can defeat regular expressions using ^ and $.

```ruby
require 'uri'
"injected\nhttp://google.com" =~ URI.regexp(%w{http})
# => 9 # => BAD, it matches

"injected\nhttp://google.com" =~ /\A#{URI.regexp(%w{http})}\z/
# => nil # => GOOD
```

Though in the UrlValidator there was a second safeguard in place by using URI.parse and matching the regexp only afterwards, I've decided to ensure that \A and \z is used anyhow in the regexp and there are now new test cases to check for these "injections".

After exploring the other validators I've noticed several places where ^ and $ are used instead of \A and \z, I've replaced occurrences of ^/$ in PostalCodeValidator, TrackingNumberValidator and TwitterValidator - includes tests for all cases.