566102 - [k] Improve parsing to filter out non-valid URL/URIs

Status: VERIFIED FIXED

(support.mozilla.org :: Forum, task, P2)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

STR:

1. Load http://support-stage-new.mozilla.com/en-US/forums/test-forum/2?page=7
2. Try to click on the links or mouse-over them (if they're just styled, and aren't linked)

None of the links are valid URI/URLs, to my knowledge; we should do better at parsing/linking them (they're all obviously SQL-injection debris).

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

(My personal favorite is http://support-stage-new.mozilla.com/en-US/forums/test-forum/2?page=8#post-162), where it links http://support-stage-new.mozilla.com/|%5C

Comment 2

[James Socol [:jsocol, :james]]

(In reply to comment #1)
> (My personal favorite is
> http://support-stage-new.mozilla.com/en-US/forums/test-forum/2?page=8#post-162),
> where it links http://support-stage-new.mozilla.com/|%5C

Technically, that is a valid URL. All those characters are allowed.

We should check whether Bleach's linkify() or the markup parser is linkifying things like `document.vulnerable`, but they are just links, to nowhere, in particular, so not all that dangerous.

Comment 3

[James Socol [:jsocol, :james]]

This was a Bleach.linkify() bug. Added tests and fixed it. Version bump to 0.3.2.

http://github.com/jsocol/bleach/commit/47edcde303

If it doesn't pick up we may have to kick pip to update, but it should be fine.

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED; really nice work!