Bug 1349899 - Clean up invalid mozreview urls on attachment page

diff --git a/extensions/BMO/Extension.pm b/extensions/BMO/Extension.pm
index 1640bd076ea8351f96d3eedb1e168f73690c5ada..40ab8424e3cf93a5c8dc753b9b82fd81813e49c4 100644 (file)
--- a/extensions/BMO/Extension.pm
+++ b/extensions/BMO/Extension.pm
@@ -1152,7 +1152,8 @@ sub _detect_attached_url {
     return unless defined $url;
     return if length($url) > 256;
     $url = trim($url);
-    return if $url =~ /\s/;
+    # ignore urls that contain unescaped characters outside of the range mentioned in RFC 3986 section 2
+    return if $url =~ m<[^A-Za-z0-9._~:/?#\[\]@!\$&'()*+,;=`.%-]>;
 
     foreach my $key (keys %autodetect_attach_urls) {
         if ($url =~ $autodetect_attach_urls{$key}->{regex}) {

diff --git a/extensions/BMO/lib/Data.pm b/extensions/BMO/lib/Data.pm
index 5b07ce6450697f87d238cc70bf84923d8c1ae924..fcb96a5583839480813dd0ffaf4e7a58207fa514 100644 (file)
--- a/extensions/BMO/lib/Data.pm
+++ b/extensions/BMO/lib/Data.pm
@@ -26,6 +26,22 @@ our @EXPORT = qw( $cf_visible_in_products
 # Creating an attachment whose contents is a URL matching one of these regexes
 # will result in the user being redirected to that URL when viewing the
 # attachment.
+
+my $mozreview_url_re = qr{
+    # begins with mozreview hostname
+    ^
+    https?://reviewboard(?:-dev)?\.(?:allizom|mozilla)\.org
+
+    # followed by a review path
+    /r/\d+
+
+    # ends with optional suffix
+    (?: /
+      | /diff/\#index_header
+    )?
+    $
+}ix;
+
 our %autodetect_attach_urls = (
     github_pr => {
         title        => 'GitHub Pull Request',
@@ -35,7 +51,7 @@ our %autodetect_attach_urls = (
     },
     reviewboard => {
         title        => 'MozReview',
-        regex        => qr#^https?://reviewboard(?:-dev)?\.(?:allizom|mozilla)\.org/r/\d+/?#i,
+        regex        => $mozreview_url_re,
         content_type => 'text/x-review-board-request',
         can_review   => 1,
     },

diff --git a/extensions/MozReview/template/en/default/hook/attachment/edit-view.html.tmpl b/extensions/MozReview/template/en/default/hook/attachment/edit-view.html.tmpl
index 571d69b502be219b8e3511d3a1e9ff9ab85c4575..044c36ae9ec010dbab0462ee81dee626bdc1ea6a 100644 (file)
--- a/extensions/MozReview/template/en/default/hook/attachment/edit-view.html.tmpl
+++ b/extensions/MozReview/template/en/default/hook/attachment/edit-view.html.tmpl
@@ -12,5 +12,5 @@
   url = attachment.data;
 %]
 <h3>
-  <a href="[% url FILTER none %]" title="[% url FILTER html %]">Show review on MozReview</a><br>
+  <a href="[% url FILTER html %]" title="[% url FILTER html %]">Show review on MozReview</a><br>
 </h3>