Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sanitized wayback url from wayback machine #19786

Merged
merged 1 commit into from
Aug 21, 2023
Merged

Conversation

simonhong
Copy link
Member

@simonhong simonhong commented Aug 21, 2023

Resolves brave/brave-browser#32395

Only allow to load valid wayback url that has http/https scheme and valid wayback domain.

Submitter Checklist:

  • I confirm that no security/privacy review is needed and no other type of reviews are needed, or that I have requested them
  • There is a ticket for my issue
  • Used Github auto-closing keywords in the PR description above
  • Wrote a good PR/commit description
  • Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
  • Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
  • Checked the PR locally:
    • npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
    • npm run lint, npm run presubmit wiki, npm run gn_check, npm run tslint
  • Ran git rebase master (if needed)

Reviewer Checklist:

  • A security review is not needed, or a link to one is included in the PR description
  • New files have MPL-2.0 license header
  • Adequate test coverage exists to prevent regressions
  • Major classes, functions and non-trivial code blocks are well-commented
  • Changes in component dependencies are properly reflected in gn
  • Code follows the style guide
  • Test plan is specified in PR before merging

After-merge Checklist:

Test Plan:

WaybackMachineURLFetcherUnitTest.WaybackURLSanitizeTest

See the linked issue for manual test.

@simonhong simonhong self-assigned this Aug 21, 2023
fix brave/brave-browser#32395

Only allow to load valid wayback url that has http/https scheme and
valid wayback domain.
@simonhong simonhong merged commit 55fd575 into master Aug 21, 2023
13 checks passed
@simonhong simonhong deleted the wayback_url_sanitize branch August 21, 2023 02:38
@github-actions github-actions bot added this to the 1.59.x - Nightly milestone Aug 21, 2023
simonhong added a commit that referenced this pull request Aug 25, 2023
Sanitized wayback url from wayback machine
simonhong added a commit that referenced this pull request Aug 25, 2023
Sanitized wayback url from wayback machine
@kjozwiak
Copy link
Member

Verification PASSED on Win 11 x64 using the following build(s):

Brave | 1.59.56 Chromium: 116.0.5845.114 (Official Build) nightly (64-bit)
-- | --
Revision | 11676eb8c4bf058787c740d5fd2d089971f5d942
OS | Windows 11 Version 22H2 (Build 22621.2215)

Using the STR/Cases outlined via brave/brave-browser#32395 (comment), ensured that Sorry, there is no saved version available. was being displayed when visiting https://brave.com/bo/ and clicking on Check for saved versions via the Wayback Machine as per the following:

  • using Fiddler, created a new rule to change the JSON response for https://brave-api.archive.org/wayback/available?url=https://brave.com/bo/ to the JSON that's mentioned via [hackerone] validate wayback URL before navigating brave-browser#32395 (comment)
  • enabled the Fiddler rule and visited https://brave.com/bo/
  • ensured that clicking Check for saved versions displayed Sorry, there is no saved version available. via the banner
Example Example Example Example
hacker1 hacker2 hacker3 hacker4

kjozwiak pushed a commit that referenced this pull request Aug 30, 2023
…(uplift to 1.58.x) (#19892)

* Uplift of #19780 (squashed) to beta

* Merge pull request #19786 from brave/wayback_url_sanitize

Sanitized wayback url from wayback machine

---------

Co-authored-by: Simon Hong <shong@brave.com>
kjozwiak pushed a commit that referenced this pull request Aug 30, 2023
…(uplift to 1.57.x) (#19893)

* Uplift of #19780 (squashed) to release

* Merge pull request #19786 from brave/wayback_url_sanitize

Sanitized wayback url from wayback machine

---------

Co-authored-by: Simon Hong <shong@brave.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants