42609 - Only allow well formed URLs in URL field of bug report

Status: VERIFIED FIXED

(Bugzilla :: Bugzilla-General, enhancement, P3)

Description

[Matthew Cline]

Some people enter an URL in the URL field of a bug report without
the "http://" at the beginning; when clicking on such a link, it treats
it as relative to http://bugzilla.mozilla.org/.  URLs like that should
be rejected.

Comment 1

[Mitchell Baker]

reassigning to dawn, cc'ing dmose, for bugzilla issues

Comment 2

[Dawn Endico]

moving to bugzilla component

Comment 3

[Matthew Tuck [:CodeMachine]]

*** Bug 43136 has been marked as a duplicate of this bug. ***

Comment 4

[Sean Richardson]

There's a dueling proposal in bug 37684, "[RFE] automatic http:// in bugzilla 
URL field" ... if this gets fixed as proposed, that RFE will be invalidated.

A cogent "try again" message is surely more productive than an attempt to
patch enter_bug.cgi to silently fix URLs lacking schemes, especially since
such a patch would either sometimes prepend "http://" where it does not
belong, or, if stricter, sometimes miss prepending "http://" where it *does* 
belong.

There may, however, be situations where it would be useful to allow non-URL text
in the URL field so long as a well-formed URL does appear, as in this example 
from bug 45543: "http://unicode.org/iuc/iuc10/x-utf8.html  and 
http://home.netscape.com/ko and http://www.joins.com" 

See RFE bug 45739, "Restrict URL field link to first well formed URL in field", 
for discussion of how such field contents could be sensibly handled if allowed 
to be entered.

Comment 5

[Chris Yeh]

marking for possible 2.12

Comment 6

[Chris Yeh]

i think the best solution for the bug is to prime the field with "http://" so 
that it's easy for people to realize that http:// should be a part of a 
submitted url.

if the right thing to do is to not use http:// (for instance, a mailto:) then 
they can just delete it and enter in the right thing.

feedback? i'm not enthused about trying to enforce well formatted urls. i am 
interested in making it easy for people to do the right thing.

Comment 7

[Chris Yeh]

Attachment: proposed fix

Comment 8

[Chris Yeh]

so i just uploaded an attachment for a proposed patch and fix for this bug.
what it does is this:

enter_bug.cgi now will start with a default text entry value of "http://". if
you want to override this value you can with whatever you want.

then in post_bug.cgi i check to see if bug_file_loc has only an "http://". if it
does. it substitutes a null value and commits that to the database. (meaning
nothing was added to the URL field)

if the URL field was changed, then pass that to the database.

although, i'm looking at the patch now, and i realize that there's a bug in it.
ooops. let me fix that and put up a new one.

Comment 9

[Chris Yeh]

Attachment: real proposed fix

Comment 10

[Chris Yeh]

committed fix to trunk.

Comment 11

[Tara Hernandez]

Sorry for the spam, but I needed to be able to query for all of these correctly.

Comment 12

[Jacob Steenhagen]

Yep.

Comment 13

[Sean Richardson]

Historical note: the FIX for this bug is actually the one asked for by 
bug 37684, "[RFE] automatic http:// in bugzilla URL field", not the one
asked for by this bug's reporter.

Comment 14

[Dave Miller [:justdave]]

Moving closed bugs to Bugzilla product