bramus / bramus/mixed-content-scan
Sourced content (http or https) should never warn or error if it's prefixed by the top-level site URL
- Dominant language
- PHP
- Stars
- 517
- Forks
- 50
- PR merge metrics
- No merged PRs in 30d
Description
I want to use mixed-content-scan on http-only WordPress sites before I convert them to https. WordPress infuriatingly uses absolute URLs for its own internal links (e.g. for its own CSS, JS, images) and mixed-content-scan seems to pick up all these http:// internal links as warnings/errors.
I tried putting just ^{$rooturl} in ignorepatterns/wordpress.txt (and pointed --ignore= to that file), but mixed-content-scan still kept reporting the absolute-but-internal http:// URLs as warnings/errors.
mixed-content-scan should probably never warn/error on a sourced URL that is prefixed with the site URL that's passed to the script since that's actually an internal URL that will become https://-prefixed when I do the "usual" DB search-replace on the WordPress http site to convert the site to https. Yes, I've complained bitterly to the WP devs that they use absolute URLs for internal sourcing/linking but they just stick their fingers in their ears and ignore me :-(
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading how mixed-content-scan handles sourced URLs, the site URL passed to the script, and --ignore patterns such as ignorepatterns/wordpress.txt. Reproduce the issue with WordPress-style absolute internal http:// links; done means URLs prefixed by the site URL produce no warnings or errors while external mixed-content URLs remain reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100