Don't rewrite non http URLs in bbcode

GanstaZ · Post by **GanstaZ** » Mon Jun 04, 2018 8:52 pm

It is a relative path, that's why you get something(phpbb.com, your site, mine and whatever)/google.com. As mentioned above, it can be changed, but it doesn't smell as core implementation.

Toxyy · Post by **Toxyy** » Tue Jun 05, 2018 12:56 am

GanstaZ wrote: ↑Mon Jun 04, 2018 8:52 pm It is a relative path, that's why you get something(phpbb.com, your site, mine and whatever)/google.com. As mentioned above, it can be changed, but it doesn't smell as core implementation.

But again, who in the world writes

Code: Select all

[url]google.com[/url] or [url=google.com]test url[/url]

, either of those, and means a relative path? I have never ever written google.com and intended some sort of local myurl.com/google.com. Not once.

GanstaZ · Post by **GanstaZ** » Tue Jun 05, 2018 1:29 am

Well.. it's not about intended or not (right or wrong), it's just the way it is. It was explained what/why on a previous page & how to modify it, if needed.

Toxyy · Post by **Toxyy** » Tue Jun 05, 2018 1:40 am

GanstaZ wrote: ↑Tue Jun 05, 2018 1:29 am Well.. it's not about intended or not (right or wrong), it's just the way it is. It was explained what/why on a previous page & how to modify it, if needed.

Understood.

AmigoJack · Post by **AmigoJack** » Tue Jun 05, 2018 6:23 am

Toxyy wrote: ↑Mon Jun 04, 2018 8:46 pmHave you ever written google.com and meant phpbb.com/google.com?

Toxyy wrote: ↑Tue Jun 05, 2018 12:56 amwho in the world writes [url]google.com[/url] or [url=google.com]test url[/url], either of those, and means a relative path?

That's too short sighted - one may want to write exec.cgi, not just google.com. But what distinguishes both when you want to make a pattern out of it? Nothing. Hence, phpBB would need to explicitly know that whenever "Google" plus dot plus 2 or 3 letters (mind those using the localized version) is written it's meant as domain, not as text or relative URL. In contrast to "New Hype" plus dot plus com or any other yet unknown company name.

Toxyy · Post by **Toxyy** » Tue Jun 05, 2018 6:29 am

AmigoJack wrote: ↑Tue Jun 05, 2018 6:23 am That's too short sighted - one may want to write exec.cgi, not just google.com. But what distinguishes both when you want to make a pattern out of it? Nothing. Hence, phpBB would need to explicitly know that whenever "Google" plus dot plus 2 or 3 letters (mind those using the localized version) is written it's meant as domain, not as text or relative URL. In contrast to "New Hype" plus dot plus com or any other yet unknown company name.

Alright, how about certain domain endings can be in a non relative list, while certain file endings can be in a relative list?

AmigoJack · Post by **AmigoJack** » Tue Jun 05, 2018 6:51 am

You mean like command.com and file.java and pron.zip which can occur in both? Today we have this list to vaguely know which exist; tomorrow others can already exist.

Toxyy · Post by **Toxyy** » Tue Jun 05, 2018 5:19 pm

Well I don't think most people are trying to references relative path when using

Code: Select all

[url]

in the first place. But let's say they want to reference

Code: Select all

[url]command.com[/url]

as a relative path, along with the whitelisting idea, local files could be whitelisted as well.

Elsensee · Post by **Elsensee** » Sun Sep 16, 2018 11:02 am

I've changed the status to "Invalid" as this won't really work. An URL should contain a scheme-part like "https://" or "ftp://" or "mailto:", if there isn't this is a hard problem for a computer to solve. Humans might know that "google.com" should go to https://google.com, but let's say you wanna access "access.sh", which is a valid domain but could also be a common file on file systems. You might not want to access it from a browser but there's really no easy way to decide there.

Btw, the way that @JimA proposed the change (make it only relative when there's a slash in front of it) wouldn't work either, because //google.com might also be something somebody wants to go to..

So we just go by the standard I guess.

Votes

Status