diff options
Diffstat (limited to 'extensions/BMO')
| -rw-r--r-- | extensions/BMO/Extension.pm | 3 | ||||
| -rw-r--r-- | extensions/BMO/lib/Data.pm | 18 |
2 files changed, 19 insertions, 2 deletions
diff --git a/extensions/BMO/Extension.pm b/extensions/BMO/Extension.pm index 1640bd076..40ab8424e 100644 --- a/extensions/BMO/Extension.pm +++ b/extensions/BMO/Extension.pm @@ -1152,7 +1152,8 @@ sub _detect_attached_url { return unless defined $url; return if length($url) > 256; $url = trim($url); - return if $url =~ /\s/; + # ignore urls that contain unescaped characters outside of the range mentioned in RFC 3986 section 2 + return if $url =~ m<[^A-Za-z0-9._~:/?#\[\]@!\$&'()*+,;=`.%-]>; foreach my $key (keys %autodetect_attach_urls) { if ($url =~ $autodetect_attach_urls{$key}->{regex}) { diff --git a/extensions/BMO/lib/Data.pm b/extensions/BMO/lib/Data.pm index 5b07ce645..fcb96a558 100644 --- a/extensions/BMO/lib/Data.pm +++ b/extensions/BMO/lib/Data.pm @@ -26,6 +26,22 @@ our @EXPORT = qw( $cf_visible_in_products # Creating an attachment whose contents is a URL matching one of these regexes # will result in the user being redirected to that URL when viewing the # attachment. + +my $mozreview_url_re = qr{ + # begins with mozreview hostname + ^ + https?://reviewboard(?:-dev)?\.(?:allizom|mozilla)\.org + + # followed by a review path + /r/\d+ + + # ends with optional suffix + (?: / + | /diff/\#index_header + )? + $ +}ix; + our %autodetect_attach_urls = ( github_pr => { title => 'GitHub Pull Request', @@ -35,7 +51,7 @@ our %autodetect_attach_urls = ( }, reviewboard => { title => 'MozReview', - regex => qr#^https?://reviewboard(?:-dev)?\.(?:allizom|mozilla)\.org/r/\d+/?#i, + regex => $mozreview_url_re, content_type => 'text/x-review-board-request', can_review => 1, }, |