Extension:UrlShortener has a default setting of UrlShortenerAllowedDomains: false, which is meant to translate to allowing only the current domain. Given that $wgUrlShortenerAllowedDomains takes a regex, the code defaults to generating a regex on-demand derived from wgServer, like so:
Gerrit: UrlShortenerUtils.php#422
public function getAllowedDomainsRegex(): string { $allowedDomains = $this->config->get( 'UrlShortenerAllowedDomains' ); if ( $allowedDomains === false ) $serverParts = $this->urlUtils->parse( $this->config->get( MainConfigNames::Server ) ) ?? []; return preg_quote( $serverParts['host'], '/' ); } return implode( '|', array_map( static function ( $item ) { return '^' . $item . '$'; }, $allowedDomains ) ); }
While an array of custom regexes is correctly given a start and end anchor (caret ^, and dollar $), the default is not.
It seems this bug has been there since the first version of this mechanism was committed in 2014 (change 139579).
Problem
Proposed solution
Applying a start/end anchor is simple, but would break www and other subdomains. I suggest as a default, we do the same that we do in production, which allows optional subdomains:
^(.*\.)?wikipedia\.org$
This would make the security patch not a breaking change, and aligns it with future direction of T418430, where Proposal 1 would produce the same behavior.