Last modified: 2005-12-27 16:51:13 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T6377, the corresponding Phabricator task for complete and up-to-date bug report information.

Bug 4377 - Spam blacklist can be evaded by adding square bracket to URL


Summary:	Spam blacklist can be evaded by adding square bracket to URL

Status:	RESOLVED FIXED

Product:	MediaWiki
Classification:	Unclassified
Component:	Parser (Other open bugs)
Version:	unspecified
Hardware:	All All

Importance:	Normal normal (vote)
Target Milestone:	---
Assigned To:	Nobody - You can work on this!

URL:	http://jv.wiktionary.org/w/index.php?...
Whiteboard:
Keywords:

Duplicates:	4384 (view as bug list)
Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2005-12-24 06:46 UTC by Korg
Modified:	2005-12-27 16:51 UTC (History)
CC List:	1 user (show)

See Also:
Web browser:	---
Mobile Platform:	---
Assignee Huggle Beta Tester:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Korg 2005-12-24 06:46:33 UTC

The spam blacklist extension will not match URLs which contain square brackets. For
example, if a line in a blacklist file is:

example\.com

then [http://spam.example.com/] will be blocked but
[http://spam.[.example.com/] will be ignored.

Cheers, Korg

Comment 1 Brion Vibber 2005-12-24 06:59:37 UTC

Since that wouldn't be a valid URL, it shouldn't be getting picked up as a link at all.

Comment 2 Korg 2005-12-24 09:54:24 UTC

The URL seems to be valid, we can go to the website.

The domain 0s48.info is blacklisted, but the spammer continues to spam:
http://bo.wiktionary.org/w/index.php?title=Wiktionary:General_disclaimer&curid=1557&diff=4200&oldid=4162
http://bs.wiktionary.org/w/index.php?title=Wiktionary:General_disclaimer&diff=4654&oldid=4599
http://la.wiktionary.org/w/index.php?title=Current_events&diff=prev&oldid=19872

Comment 3 Brion Vibber 2005-12-24 09:55:28 UTC

It's invalid in that the "]" character is explicitly disallowed in URLs. Some software is lax in 
treating this.

Comment 4 Brion Vibber 2005-12-24 10:09:51 UTC

Any such invalid links are now broken.

Comment 5 Korg 2005-12-24 10:17:06 UTC

Thanks Brion!

Comment 6 Florian Steinel 2005-12-27 16:51:13 UTC

*** Bug 4384 has been marked as a duplicate of this bug. ***

Wikimedia Bugzilla is closed!

Search

Personal tools

Navigation

Links