Exclude _wpnonce URLs in speculation rules #1143
Conversation
westonruter
added
[Type] Bug
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
|
Nice thorough set of tests btw. Anyway we can add them to the plugin test suite so if someone in future isn't as robust as you, it's still covered? |
That's a good idea. I've opened #1144 to explore that. |
This is a sub-PR of #1142.
Fixes #1141
The URLPattern used to exclude URLs with
_wpnonceis/*\?*(^|&)_wpnonce=*. Take special note that the second*wildcard only matches chars in the query segment. Additionally, the^anchors the match to the beginning of thesearchsegment, and not to the beginning of the entire string. (Remember:URLPatternis not regex.) This means that only the_wpnoncequery parameter will matched, whether it is the first query parameter or not. It also won't incorrectly matchother_wpnonce.The following URLs were tested to be properly included and excluded:
http://example.com/foo/?_wpnonce=1234http://example.com/?_wpnonce=1234http://example.com/foo/?amp=1&_wpnonce=1234http://example.com/?amp=1&_wpnonce=1234http://example.com/foo/?_wpnonce=1234&=1http://example.com/?_wpnonce=1234&=1http://example.com/?my_wpnonce=1234_wpnonce)http://example.com/?p=1#?_wpnonce=1234http://example.com/_wpnonce=1234/