467018 - "URL" gets converted to "ur<x>l"

Status: RESOLVED FIXED

(support.mozilla.org :: Knowledge Base Software, task)

Description

[Chris Ilias [:cilias]]

1. Go to <http://support.mozilla.com/en-US/kb/Error+opening+Internet+shortcut+or+local+HTML+file>. (It's in the staging area, so you need to log in.)
2. Edit the article, replacing instances of ur<x>l with URL.
3. Save the edit.

Result: ur<x>l is back.

Comment 2

[Majken Connor [:Kensie]]

To give more information, it's because the url is being followed by :HyperText if you remove the : it displays fine.

Comment 3

[Underpass]

Hi Lucy, 

In this page

http://support.mozilla.com/it/kb/Impostazioni+di+Firefox

although I don't have any ":", I still see ur<x>l

Comment 4

[[:Cww]]

Ok, really easy quick fix:

replace url with ur~tc~ ~/tc~l.

Comment 5

[Majken Connor [:Kensie]]

(In reply to comment #3)
> Hi Lucy, 
> 
> In this page
> 
> http://support.mozilla.com/it/kb/Impostazioni+di+Firefox
> 
> although I don't have any ":", I still see ur<x>l

I checked the history, and the only instance of ur<x>l was in fact  "dei proxy (ur<x>l):"

Comment 6

[Underpass]

ok, but it is after the ")". Does it count anyway? :-P

Thanks for the quickfix, though.

Comment 7

[Majken Connor [:Kensie]]

it does, I'm not sure how many characters away it has to be before it doesn't happen, or maybe it's not characters away but there has to be another letter or another word. I can test it out later if someone doesn't beat me to it.

Comment 8

[Underpass]

I read somewhere that this problem can be solved with an update of TikiWiki platform. If you google a bit, I'm sure you'll stumble upon this.

Comment 9

[Matthew Middleton (:zzxc)]

This is only triggered when the word url (or blink, alert, or expression) are used on the same line as non-alphanumeric characters before and after the word.  These include { and ., which are often used in tikiwiki markup.

Since script and style tags are already blocked, having these words blocked at all seems unnecessary.  I haven't looked at the security bugs that prompted the upgrade in the XSS sanitizer; we should make sure we aren't regressing any known script insertion bugs when changing the words or regexes used here.

Comment 10

[Chris Ilias [:cilias]]

CCing Laura, re comment 9.

Comment 12

[[:Cww]]

if everyone uses the workaround exactly as written, we can easily find the broken pages to fix them back when this bug is fixed.

Comment 14

[Laura Thomson :laura]

The patch in 497109 will fix this.

Comment 15

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified duplicate.

Comment 16

[Chris Ilias [:cilias]]

Reopening.
Bug 497109 was marked as wontfix, so we need something specifically for this problem.

Comment 17

[[:Cww]]

More specifically, it doesn't actually look like the solution proposed in bug 497109 will fix this.

Comment 18

[James Socol [:jsocol, :james]]

Fixed by Kitsune.