If passed Range shorthand (duck typed), handle as text

[nacengineer]

We ran across a weird corner case when using the blacklight and blacklight_range_limit gems. Where if the text passed to sanitize gets duck typed to a range, then an error is raised.

The range will get past the initial short circuit because it's a valid object but then will fail on the empty? call because range doesn't have the method empty? on it.

I've added a few tests as best I could although I might have missed one or two. The modified the checks to handle a range by checking if it's an instance of Range and if so then calling to_s on it so that it can merrily pass along through the sanitization process.

Any input is appreciated.

[flavorjones]

Thanks for opening this PR to discuss what you're seeing.

I'm afraid I don't understand how or why a Range is being passed to the sanitizer, that seems like a bug in the code that's calling the sanitizer. Can you help me understand why you think this should be fixed in rails-html-sanitizer?

[nacengineer]

oh it's definitely a bug on the blacklight side but I think it highlights an edge case of the sanitization gem as what's being passed is actually just text that is a shorthand range format, e.g. "2001..2005", which is getting duck typed into a range in the santize gem and failing because it passes the truthy test (return unless html) but doesn't pass the empty? test because range doesn't have the empty? method.

[flavorjones]

@nacengineer Thanks for providing some additional context, but I still don't understand how or why a Range object is being passed to the sanitizer. Maybe if you provided a full reproduction to help me understand why you want to make this change?

Unless you can provide more information to change my mind, I would prefer if we either fixed this by performing a type check and raising an ArgumentError if the input isn't a String, (rather than try to add support for new types) or else just didn't fix it at all (this gem's API has remained unchanged since 2013, and it was extracted from a Rails API that was unchanged before that since at least 2008, so I'm not yet convinced this is really a problem).