Test protection introduced in e98635a

ifad · Nov 12, 2023 · 623d0bd · 623d0bd
1 parent 9ff671e
commit 623d0bd
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/spec/omniauth/strategies/cas_spec.rb b/spec/omniauth/strategies/cas_spec.rb
@@ -91,6 +91,14 @@
   describe 'GET /auth/cas' do
     let(:return_url) { 'http://example.org/admin/foo' }
 
+    context 'with a return url on a different host than the service url' do
+      before { get '/auth/cas?url=http://attack.example.org/' }
+
+      subject { last_response }
+
+      it { should be_bad_request }
+    end
+
     context 'with a referer' do
       let(:url) { '/auth/cas' }