By matt v. on

I'm working on a module that allows users to enter search "commands" and be redirected to search results on another site (a la yubnub.org).

Everything was working great until I started running check_url on the destination urls, which encodes all the ampersands (causing arguments in the URL to get garbled).

Here's the relevant code (or here's the full function, in case it might help):

  // inject arguments
  $url = str_replace('%s', $arguments, $url);
  
  if (!ereg(":", $url)) {
    drupal_goto(check_plain($url));
  }
  else {
    // check_url is breaking some commands, since ampersands get encoded.
    drupal_set_header("Location: ". check_url($url));
  }

Any recommendations on how to safely work around that? In addition, I'd welcome any security (or general) feedback on the module.

⋅ Categories: Drupal 6.x

Comments

imrook’s picture

imrook commented

The check_url function performs the following action:
Prepare a URL for use in an HTML attribute. Strips harmful protocols.
The first part is causing you problems as you don't wish to display the URL, but use it as a header location. What you want is most of http://api.drupal.org/api/function/filter_xss_bad_protocol without calling check_plain() at the end. Unfortunately, it doesn't look like that function has been decomposed enough for you to call the portion you need. I'd recommend re-implementing it for your own use without calling check_plain. This will keep your URL's browser friendly.

matt v.’s picture

matt v. commented

Thanks for you help. I got it working again by using explode to break the URL apart, check the individual pieces, then used implode to put it back together. It may not be particularly efficient, but it seems to be working well, so far:

  if (!ereg(":", $url)) {
    drupal_goto(check_plain($url));
  }
  else {
    // The check_url function broke some commands by encoding ampersands.
    // Instead, we check the individual pieces and put them back together.
    $url_pieces = explode('&', $url);
    foreach ($url_pieces as $key => $url_piece) {
      if ($key == 0) {
        $url_pieces[$key] = check_url($url_piece);
      } else {
        $url_pieces[$key] = check_plain($url_piece);
      }
    }
    $url = implode('&', $url_pieces);
    drupal_set_header("Location: ". $url);
  }