Regular expressions with validations in RoR 4

Question

There is the following code:

class Product < ActiveRecord::Base   validates :title, :description, :image_url, presence: true   validates :price, numericality: {greater_than_or_equal_to: 0.01}   validates :title, uniqueness: true   validates :image_url, allow_blank: true, format: {       with: %r{\.(gif|jpg|png)$}i,       message: 'URL must point to GIT/JPG/PNG pictures'   } end 

It works, but when I try to test it using "rake test" I'll catch this message:

rake aborted! The provided regular expression is using multiline anchors (^ or $), which may present a security risk. Did you mean to use \A and \z, or forgot to add the :multiline => true option? 

What does it mean? How can I fix it?

Answer 1

^ and $ are Start of Line and End of Line anchors. While \A and \z are Permanent Start of String and End of String anchors.
See the difference:

string = "abcde\nzzzz" # => "abcde\nzzzz"  /^abcde$/ === string # => true  /\Aabcde\z/ === string # => false 

So Rails is telling you, "Are you sure you want to use ^ and $? Don't you want to use \A and \z instead?"

There is more on the rails security concern that generates this warning here.