fix: accept escaped public feed tokens

Author: gildesmarais

app/feeds/request_parser.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'cgi'
 require_relative 'request'
 require_relative 'response_format'
 
@@ -15,17 +16,37 @@ class << self
           # @param identifier [String]
           # @return [Html2rss::Web::Feeds::Request]
           def call(request:, target_kind:, identifier:)
-            representation = ResponseFormat.for_request(request)
-            normalized_identifier = ResponseFormat.strip_known_extension(identifier)
+            build_request(
+              request: request,
+              target_kind: target_kind,
+              identifier: normalize_identifier(target_kind, ResponseFormat.strip_known_extension(identifier))
+            )
+          end
+
+          private
 
+          # @param request [Rack::Request]
+          # @param target_kind [Symbol]
+          # @param identifier [String]
+          # @return [Html2rss::Web::Feeds::Request]
+          def build_request(request:, target_kind:, identifier:)
             Request.new(
               target_kind: target_kind,
-              representation: representation,
-              feed_name: target_kind == :static ? normalized_identifier : nil,
-              token: target_kind == :token ? normalized_identifier : nil,
+              representation: ResponseFormat.for_request(request),
+              feed_name: target_kind == :static ? identifier : nil,
+              token: target_kind == :token ? identifier : nil,
               params: request.params.to_h
             )
           end
+
+          # @param target_kind [Symbol]
+          # @param identifier [String]
+          # @return [String]
+          def normalize_identifier(target_kind, identifier)
+            return identifier unless target_kind == :token
+
+            CGI.unescape(identifier)
+          end
         end
       end
     end

spec/html2rss/web/app_integration_spec.rb

@@ -2,6 +2,7 @@
 
 require 'spec_helper'
 require 'rack/test'
+require 'cgi'
 require 'json'
 require 'securerandom'
 require_relative '../../../app'
@@ -13,6 +14,7 @@
 
   let(:feed_url) { 'https://example.com/articles' }
   let(:feed_token) { "valid-feed-token-#{SecureRandom.hex(4)}" }
+  let(:encoded_feed_token) { CGI.escape(feed_token) }
 
   let(:account) do
     {
@@ -94,6 +96,18 @@
       expect(last_response.body).to eq('<rss version="2.0"></rss>')
     end
 
+    it 'accepts URL-escaped public feed tokens', :aggregate_failures do
+      padded_feed_token = 'signed-public-token='
+      encoded_padded_feed_token = CGI.escape(padded_feed_token)
+
+      stub_escaped_feed_token(raw_token: padded_feed_token, encoded_token: encoded_padded_feed_token)
+
+      get "/api/v1/feeds/#{encoded_padded_feed_token}", {}, { 'HTTP_ACCEPT' => 'application/xml' }
+
+      expect(last_response.status).to eq(200)
+      expect(last_response.headers['Content-Type']).to eq('application/xml')
+    end
+
     it 'renders the JSON feed when requested by extension', :aggregate_failures do
       get "/api/v1/feeds/#{feed_token}.json"
 
@@ -166,6 +180,23 @@
         [401, 'application/feed+json', { 'version' => 'https://jsonfeed.org/version/1.1', 'title' => 'Error' }]
       )
     end
+
+    # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+    def stub_escaped_feed_token(raw_token:, encoded_token:)
+      escaped_token_payload = instance_double(
+        Html2rss::Web::FeedToken,
+        url: feed_url,
+        username: account[:username],
+        strategy: 'ssrf_filter'
+      )
+
+      allow(Html2rss::Web::FeedToken).to receive(:decode).with(raw_token).and_return(escaped_token_payload)
+      allow(Html2rss::Web::FeedToken).to receive(:decode).with(encoded_token).and_return(nil)
+      allow(Html2rss::Web::FeedToken)
+        .to receive(:validate_and_decode).with(raw_token, feed_url, anything)
+        .and_return(escaped_token_payload)
+    end
+    # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
   end
 
   describe 'POST /api/v1/feeds' do # rubocop:disable RSpec/MultipleMemoizedHelpers