Bookmarklets may fail on pages which title is a URL
Open
Nobody has claimed this yet.
api
bug
- Dominant language
- PHP
- Stars
- 12.2k
- Forks
- 2.1k
- Avg merge
- 6h 15m
- Merged PRs (30d)
- 7
Description
As seen in #1670 : if a document <title> is a URL, the bookmarklet will generate a &t=http://... which will make mod_security trip up
Possible fix would be to split the title like we did with the URL at any http: part but :
- what if multiple 'http://' occurences?
- is it multibyte safe? (is that a concern anyway?)
- ?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by tracing how the bookmarklet builds its query parameters, then reproduce the case where the document title is a URL and inspect the generated &t= value. Done means URL titles no longer produce a request that triggers mod_security, with the multiple-URL and multibyte cases addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, php
- Domain
- web-dev
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100