Blacklist mechanism is needed.

app/controllers/quotes_controller.rb

@@ -41,8 +41,10 @@ def html
 
   def show
     @url  = params[:u]
-    @thumbnail = ThumbnailRule.quote @url
-    @page      = HtmlRule.quote @url
+    unless Blacklist.include?(@url)
+      @thumbnail = ThumbnailRule.quote @url
+      @page      = HtmlRule.quote @url
+    end
     render status: 404, text: '404 Not found' unless @page
   end
 

app/models/blacklist.rb

@@ -0,0 +1,10 @@
+class Blacklist
+  DEFAULT_LIST = ['localhost', '127.0.0.1']
+
+  def self.include?(url)
+    additional_list = (ENV['BLACKLIST'] || '').split
+    uri = URI.parse(url)
+    (DEFAULT_LIST + additional_list).include?(uri.host)
+  end
+end
+

spec/controllers/quotes_controller_spec.rb

@@ -6,4 +6,9 @@
     subject { response }
     its(:response_code) { should eq 404 }
   end
+  context 'show with blacklisted url' do
+    before { get :show, :u => 'http://localhost/' }
+    subject { response }
+    its(:response_code) { should eq 404 }
+  end
 end

spec/models/blacklist_spec.rb

@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+require 'spec_helper'
+
+describe Blacklist do
+  describe "include?" do
+    context "matched" do
+      subject { Blacklist.include?('http://localhost/') }
+      it { should be_true }
+    end
+    context "unmatched" do
+      subject { Blacklist.include?('http://twitter.com/') }
+      it { should be_false }
+    end
+    context "use ENV" do
+      before { ENV['BLACKLIST'] = 'www.codefirst.org' }
+      subject { Blacklist.include?('http://www.codefirst.org/') }
+      it { should be_true }
+    end
+  end
+end