bramus / bramus/mixed-content-scan

Sourced content (http or https) should never warn or error if it's prefixed by the top-level site URL

Open
#60 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
517
Forks
50
PR merge metrics
No merged PRs in 30d

Description

I want to use mixed-content-scan on http-only WordPress sites before I convert them to https. WordPress infuriatingly uses absolute URLs for its own internal links (e.g. for its own CSS, JS, images) and mixed-content-scan seems to pick up all these http:// internal links as warnings/errors.

I tried putting just ^{$rooturl} in ignorepatterns/wordpress.txt (and pointed --ignore= to that file), but mixed-content-scan still kept reporting the absolute-but-internal http:// URLs as warnings/errors.

mixed-content-scan should probably never warn/error on a sourced URL that is prefixed with the site URL that's passed to the script since that's actually an internal URL that will become https://-prefixed when I do the "usual" DB search-replace on the WordPress http site to convert the site to https. Yes, I've complained bitterly to the WP devs that they use absolute URLs for internal sourcing/linking but they just stick their fingers in their ears and ignore me :-(

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading how mixed-content-scan handles sourced URLs, the site URL passed to the script, and --ignore patterns such as ignorepatterns/wordpress.txt. Reproduce the issue with WordPress-style absolute internal http:// links; done means URLs prefixed by the site URL produce no warnings or errors while external mixed-content URLs remain reported.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.