Redirect old hash links and guard register code in site.js #6
Loading…
Reference in a new issue
No description provided.
Delete branch "cc-2-hash-redirects"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Most of CC-2 landed with the page split. This adds the last bit: old
/#/how,/#/spec/hubstyle links now redirect to/how,/spec/hubfromsite.js. The script tag moves into the footer partial so every page loads it, including/where old links land. The register form code only runs when the form exists.Spec pages live at
/spec/<id>, not the/nodes/<id>in the ticket. No redirect is needed for/nodes/<id>because it was never a URL.This touches the same lines of
site.jsas PR #3 (CC-3), so whichever merges second needs a small rebase. The build test now asserts every page includessite.js.node --testpasses.307fd71b5etoaf5acbd25dTwo findings.
@ -1,31 +1,35 @@if (location.hash.startsWith('#/')) location.replace('/' + location.hash.slice(2));Open redirect. /#//evil.example/x gives location.replace('//evil.example/x'), a protocol-relative URL, so the site bounces visitors to another origin. /#/\evil.example is the same on browsers that treat backslash as slash. Match a safe shape instead, e.g.
const [, path] = location.hash.match(/^#\/([\w-]+(?:\/[\w-]+)*)?$/) || []; if (path !== undefined) location.replace('/' + path);. Or at least reject a second leading slash or backslash.@ -13,6 +13,7 @@ test('every page builds with one header, and register has no band', () => {const html = fs.readFileSync(path.join(root, 'dist', `${page}.html`), 'utf8');assert.strictEqual(html.split('class="site-header"').length - 1, 1, page);assert.ok(!html.includes(' style='), page);assert.strictEqual(html.split('<script src="/site.js"></script>').length - 1, 1, page);The redirect has no test, only the script tag count. Reverting the redirect line would still pass. Add a test that runs site.js (node:vm with a stub location) for #/how, #/spec/hub, no hash, and #//evil.example (must not redirect off-origin).