Edgewall Software
Modify ↓

Opened 4 months ago

Last modified 3 months ago

#13783 assigned defect

Avoid spam link attack via quickjump feature of search

Reported by: Jun Omae Owned by: Jun Omae
Priority: normal Milestone: 1.6.1
Component: search system Version:
Severity: normal Keywords:
Cc: Branch:
Release Notes:
API Changes:
Internal Changes:

Description (last modified by Jun Omae) 

diff --git a/trac/search/templates/search.html b/trac/search/templates/search.html
index c9ad6578b..a4aaafd3b 100644
--- a/trac/search/templates/search.html
+++ b/trac/search/templates/search.html
@@ -30,6 +30,7 @@ history and logs, available at https://trac.edgewall.org/.
     ${ super() }

     #   if results:
+    <meta name="ROBOTS" content="NOINDEX, NOFOLLOW" />
     <meta name="startIndex" content="${results.span[0] + 1}"/>
     <meta name="totalResults" content="${results.num_items}"/>
     <meta name="itemsPerPage" content="${results.max_per_page}"/>

Attachments (0)

Change History (1)

comment:1 by Jun Omae, 3 months ago

Description: modified (diff)

In addition, search: link should have ref="nofollow" attribute.

  • trac/search/web_ui.py 

    diff --git a/trac/search/web_ui.py b/trac/search/web_ui.py
index 4e7789a61..9f528481e 100644
    a b class SearchModule(Component):  
    140140        else:
    141141            href = formatter.href.search() + quote_query_string(query)
    142142        href += fragment
    143         return tag.a(label, class_='search', href=href)
     143        return tag.a(label, rel='nofollow', class_='search', href=href)
    144144
    145145    # IRequestHandler helper methods
    146146

  • trac/tests/wikisyntax.py 

    diff --git a/trac/tests/wikisyntax.py b/trac/tests/wikisyntax.py
index 1a9f0c3c0..90b89a686 100644
    a b search:"foo bar"  
    3232[search:]
    3333------------------------------
    3434<p>
    35 <a class="search" href="/search?q=foo">search:foo</a>
    36 <a class="search" href="/search?q=foo+bar">search:"foo bar"</a>
    37 <a class="search" href="/search?q=bar">Bar</a>
    38 <a class="search" href="/search?q=bar">bar</a>
    39 <a class="search" href="/search">search</a>
     35<a class="search" href="/search?q=foo" rel="nofollow">search:foo</a>
     36<a class="search" href="/search?q=foo+bar" rel="nofollow">search:"foo bar"</a>
     37<a class="search" href="/search?q=bar" rel="nofollow">Bar</a>
     38<a class="search" href="/search?q=bar" rel="nofollow">bar</a>
     39<a class="search" href="/search" rel="nofollow">search</a>
    4040</p>
    4141------------------------------
    4242============================== search: link resolver with query arguments
    … … search:"?q=foo bar&wiki=on"  
    4848[search:?q=bar&ticket=on Bar in Tickets]
    4949------------------------------
    5050<p>
    51 <a class="search" href="/search?q=foo&amp;wiki=on">search:foo?wiki=on</a>
    52 <a class="search" href="/search?q=foo&amp;wiki=on">search:?q=foo&amp;wiki=on</a>
    53 <a class="search" href="/search?q=foo+bar&amp;wiki=on">search:"foo bar?wiki=on"</a>
    54 <a class="search" href="/search?q=foo+bar&amp;wiki=on">search:"?q=foo bar&amp;wiki=on"</a>
    55 <a class="search" href="/search?q=bar&amp;ticket=on">Bar in Tickets</a>
    56 <a class="search" href="/search?q=bar&amp;ticket=on">Bar in Tickets</a>
     51<a class="search" href="/search?q=foo&amp;wiki=on" rel="nofollow">search:foo?wiki=on</a>
     52<a class="search" href="/search?q=foo&amp;wiki=on" rel="nofollow">search:?q=foo&amp;wiki=on</a>
     53<a class="search" href="/search?q=foo+bar&amp;wiki=on" rel="nofollow">search:"foo bar?wiki=on"</a>
     54<a class="search" href="/search?q=foo+bar&amp;wiki=on" rel="nofollow">search:"?q=foo bar&amp;wiki=on"</a>
     55<a class="search" href="/search?q=bar&amp;ticket=on" rel="nofollow">Bar in Tickets</a>
     56<a class="search" href="/search?q=bar&amp;ticket=on" rel="nofollow">Bar in Tickets</a>
    5757</p>
    5858------------------------------
    5959"""

Modify Ticket

Change Properties
Set your email in Preferences
Action
as assigned The owner will remain Jun Omae.
The ticket will be disowned. Next status will be 'new'.
as The resolution will be set. Next status will be 'closed'.
to The owner will be changed from Jun Omae to the specified user.

Add Comment
E-mail address and name can be saved in the Preferences .
Attachments ↑ Description ↑
 
Note: See TracTickets for help on using tickets.