Merge #335: reject invalid QR code requests before rendering

app/controllers/qr_code_controller.rb

@@ -7,5 +7,7 @@ class QrCodeController < ApplicationController
 
     expires_in 1.year, public: true
     render plain: qr_code, content_type: "image/svg+xml"
+  rescue ArgumentError, RQRCodeCore::QRCodeRunTimeError
+    head :bad_request
   end
 end

test/controllers/qr_code_controller_test.rb

@@ -12,4 +12,18 @@ class QrCodeControllerTest < ActionDispatch::IntegrationTest
     assert_equal 1.year, response.cache_control[:max_age].to_i
     assert response.cache_control[:public]
   end
+
+  test "show rejects an id that isn't base64" do
+    get qr_code_path("not-base64!")
+
+    assert_response :bad_request
+  end
+
+  test "show rejects a URL too long for a QR code" do
+    id = Base64.urlsafe_encode64("http://example.com/" + "a" * 3000)
+
+    get qr_code_path(id)
+
+    assert_response :bad_request
+  end
 end