URL Filter converts unsupported protocols
corey.aufang - March 25, 2010 - 20:57
| Project: | Drupal |
| Version: | 7.x-dev |
| Component: | filter.module |
| Category: | bug report |
| Priority: | critical |
| Assigned: | Unassigned |
| Status: | duplicate |
Jump to:
Description
If you create a URI like
tcp://user:pass@location:port/path
URL Filter will attempt to change it into a link because tcp:// is in the regular expression to match absolute URIs, but the protocol "tcp" is not allowed by filter_xss_bad_protocol.
This results in a link that looks like
<a href="//user:pass@location:port/path" title="//user:pass@location:port/path">tcp://user:pass@location:port/path</a>The text of the link looks correct, but this is deceptive because the href is missing the protocol.
I'm not sure of the best solution, but at first glance I see two:
- _filter_url() in /modules/filter/filter.module needs to be changed to only look for protocols that are supported by filter_xss_bad_protocol()
- filter_xss_bad_protocol() in /includes/common.inc needs be changed to support all the protocols that _filter_url() looks for
#1
applied to wrong version
#2
Thanks for taking the time to report this issue.
However, marking as duplicate of #257193: URL filter: Use filter_allowed_protocols variable.
You can follow up on that issue to track its status instead. If any information from this issue is missing in the other issue, please make sure you provide it over there.