e.g., "https://en.wikipedia.org:22" and "https://user:password@graphite.wikimedia.org" both work (the URL is shortened and the target URL preserves the port number and authentication credentials).
Since URI schemes are normalized to https / http, restricting port to ports 80 and 443 seems like a good idea. Auth credentials should be stripped or rejected as invalid input.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Ladsgroup | T44085 Wikimedia needs a URL shortener (tracking) | |||
| Resolved | Smalyshev | T112715 Enable different URL shorteners for WDQS | |||
| Resolved | Ladsgroup | T108557 Review and deploy UrlShortener extension to Wikimedia wikis | |||
| Resolved | ori | T108604 UrlShortener extension accepts arbitrary port numbers and credentials |
Is there a valid reason to include port 80/443 in URLs? We still need to support port numbers that may be in $wgServer (like in mw-vagrant for example), so might be easiest to implement this in the regex...
Auth credentials should be easy to reject since both wfParseUrl() and mw.Uri expose those.
No. Stripping port numbers outright (or rejecting URLs which contain them) would be fine, I think.
Change 230988 had a related patch set uploaded (by Legoktm):
Disallow URLs that contain ports that aren't 80 or 443 by default
Change 230988 merged by jenkins-bot:
Disallow URLs that contain ports that aren't 80 or 443 by default
Change 231744 had a related patch set uploaded (by Legoktm):
Don't allow shortening URLs with a username or password
Change 231744 merged by jenkins-bot:
Don't allow shortening URLs with a username or password