Pending

User tests: Successful: Unsuccessful:

avatar AkameOuO
AkameOuO
16 Oct 2024

Pull Request for Issue # .

Summary of Changes

According to https://datatracker.ietf.org/doc/html/rfc3986#section-3.1 , protocol (or scheme) should consist of a sequence of characters beginning with a letter and followed by any combination of letters, digits, plus ("+"), period ("."), or hyphen ("-").

Testing Instructions

URIs with custom protocols containing +, . should not be prepended with base.
And URIs with custom protocols start with number or - should be prepended with base.

Actual result BEFORE applying this Pull Request

Custom protocols like web+tea: will be prepended with base.
Custom protocols like -http: or 1http will not be prepended with base.

Expected result AFTER applying this Pull Request

Custom protocols like web+tea: will not be prepended with base.
Custom protocols like -http: or 1http will be prepended with base.

Link to documentations

Please select:

  • No documentation changes for docs.joomla.org needed

  • No documentation changes for manual.joomla.org needed

avatar AkameOuO AkameOuO - open - 16 Oct 2024
avatar AkameOuO AkameOuO - change - 16 Oct 2024
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 16 Oct 2024
Category Front End Plugins
avatar brianteeman
brianteeman - comment - 16 Oct 2024

Do we also need to fix the checks in

  • libraries\src\Form\Rule\UrlRule.php
  • administrator\components\com_menus\src\Controller\ItemController.php
avatar AkameOuO AkameOuO - change - 17 Oct 2024
The description was changed
avatar AkameOuO AkameOuO - edited - 17 Oct 2024
avatar AkameOuO
AkameOuO - comment - 17 Oct 2024

@brianteeman

  • libraries/src/Form/Rule/UrlRule.php

This file uses libraries/vendor/joomla/uri/src/UriHelper.php, which relies on parse_url(). I've tested that parse_url() allows URLs with non-alphabetic leading characters in the scheme. I'm uncertain whether this file also needs modification, given that it's related to PHP's built-in function behavior.

  • administrator/components/com_menus/src/Controller/ItemController.php

This seems ok. It appears to only allow a predefined list of URL schemes. And listed schemes won't meet this problem.

Add a Comment

Login with GitHub to post a comment