diff --git a/lib/redmine/helpers/url.rb b/lib/redmine/helpers/url.rb index 0c6cbdecd7..40801ee7c8 100644 --- a/lib/redmine/helpers/url.rb +++ b/lib/redmine/helpers/url.rb @@ -28,7 +28,7 @@ module Redmine return true unless uri.to_s.include? ":" # Other URLs need to be parsed - schemes.include? URI.parse(uri).scheme + schemes.include? URI.parse(uri.split('?').first).scheme rescue URI::Error false end diff --git a/test/unit/lib/redmine/helpers/url_test.rb b/test/unit/lib/redmine/helpers/url_test.rb index 013a7ecac4..9a04b98d6e 100644 --- a/test/unit/lib/redmine/helpers/url_test.rb +++ b/test/unit/lib/redmine/helpers/url_test.rb @@ -27,6 +27,10 @@ class URLTest < ActiveSupport::TestCase assert uri_with_safe_scheme?("https://example.com/") assert uri_with_safe_scheme?("ftp://example.com/index.html") assert uri_with_safe_scheme?("mailto:root@example.com") + + # Gravatar uri of admin@somenet.foo and parameters + assert uri_with_safe_scheme?("https://www.gravatar.com/avatar/982b6086063a22d85509455d8e31cca2?s=32&d=identicon&r=PG") + assert uri_with_safe_scheme?("https://www.gravatar.com/avatar/982b6086063a22d85509455d8e31cca2?s=32x%x%d=identiconx%x%r=PG") end def test_uri_with_safe_scheme_invalid_component