From a27c03f2a2a8be4d7ddc703254d4ce577aa9fe00 Mon Sep 17 00:00:00 2001 From: Max Kanat-Alexander Date: Sat, 18 Sep 2010 16:49:21 -0700 Subject: [PATCH] Bug 593170: Disallow urls like "show_bug.cgi?id=2323" (with no domain) in the See Also field. r=timello, a=mkanat --- Bugzilla/Bug.pm | 9 +++++++++ template/en/default/global/user-error.html.tmpl | 2 ++ 2 files changed, 11 insertions(+) diff --git a/Bugzilla/Bug.pm b/Bugzilla/Bug.pm index 9596160084..a3343a2f27 100644 --- a/Bugzilla/Bug.pm +++ b/Bugzilla/Bug.pm @@ -2385,6 +2385,15 @@ sub add_see_also { ThrowUserError('bug_url_invalid', { url => $input, reason => 'http' }); } + # This stops the following edge cases from being accepted: + # * show_bug.cgi?id=1 + # * /show_bug.cgi?id=1 + # * http:///show_bug.cgi?id=1 + if (!$uri->authority or $uri->path !~ m{/}) { + ThrowUserError('bug_url_invalid', + { url => $input, reason => 'path_only' }); + } + my $result; # Launchpad URLs if ($uri->authority =~ /launchpad.net$/) { diff --git a/template/en/default/global/user-error.html.tmpl b/template/en/default/global/user-error.html.tmpl index bde6f661fc..cef7ffefe1 100644 --- a/template/en/default/global/user-error.html.tmpl +++ b/template/en/default/global/user-error.html.tmpl @@ -250,6 +250,8 @@ [% url FILTER html %] is not a valid URL to [% terms.abug %]. [% IF reason == 'http' %] URLs must start with "http" or "https". + [% ELSIF reason == 'path_only' %] + You must specify a full URL. [% ELSIF reason == 'show_bug' %] [%+ field_descs.see_also %] URLs should point to one of: