OWASP-BLT · DonnieBLT · Nov 16, 2025 · Nov 15, 2025 · Nov 15, 2025 · Nov 15, 2025
diff --git a/website/tests/test_issues.py b/website/tests/test_issues.py
@@ -1,3 +1,4 @@
+from django.conf import settings
 from django.contrib.auth.models import User
 from django.contrib.contenttypes.models import ContentType
 from django.test import TestCase, override_settings
@@ -50,3 +51,47 @@ def test_delete_comment(self):
         response = self.client.post(url, data)
         self.assertEqual(response.status_code, 200)
         self.assertFalse(Comment.objects.filter(pk=comment.pk).exists())
+
+
+@override_settings(STATICFILES_STORAGE="django.contrib.staticfiles.storage.StaticFilesStorage")
+class GitHubIssueImageURLTests(TestCase):
+    """Test that image URLs are properly formatted for GitHub issues"""
+
+    def test_relative_url_formatting(self):
+        """Test that relative URLs get properly formatted with https protocol"""
+        relative_url = "/media/screenshots/test.png"
+
+        # Simulate the logic from create_github_issue function
+        if not relative_url.startswith(("http://", "https://")):
+            formatted_url = f"https://{settings.FQDN}{relative_url}"
+        else:
+            formatted_url = relative_url
+
+        self.assertTrue(formatted_url.startswith("https://"))
+        self.assertIn(settings.FQDN, formatted_url)
+        self.assertIn("/media/screenshots/test.png", formatted_url)
+
+    def test_absolute_url_unchanged(self):
+        """Test that absolute URLs (e.g., from GCS) are used as-is"""
+        absolute_url = "https://bhfiles.storage.googleapis.com/screenshots/test.png"
+
+        # Simulate the logic from create_github_issue function
+        if not absolute_url.startswith(("http://", "https://")):
+            formatted_url = f"https://{settings.FQDN}{absolute_url}"
+        else:
+            formatted_url = absolute_url
+
+        self.assertEqual(formatted_url, absolute_url)
+        self.assertTrue(formatted_url.startswith("https://"))
+
+    def test_http_url_unchanged(self):
+        """Test that http URLs are also preserved"""
+        http_url = "http://example.com/image.png"
+
+        # Simulate the logic from create_github_issue function
+        if not http_url.startswith(("http://", "https://")):
+            formatted_url = f"https://{settings.FQDN}{http_url}"
+        else:
+            formatted_url = http_url
+
+        self.assertEqual(formatted_url, http_url)
diff --git a/website/views/issue.py b/website/views/issue.py
@@ -181,7 +181,13 @@ def create_github_issue(request, id):
     if issue.domain.github:
         screenshot_text = ""
         for screenshot in screenshot_all:
-            screenshot_text += f"![{screenshot.image.name}]({settings.FQDN}{screenshot.image.url})\n"
+            # Get the image URL
+            image_url = screenshot.image.url
+            # Check if URL is already absolute (e.g., from Google Cloud Storage)
+            if not image_url.startswith(("http://", "https://")):
+                # Relative URL, prepend the domain with https protocol
+                image_url = f"https://{settings.FQDN}{image_url}"
+            screenshot_text += f"![{screenshot.image.name}]({image_url})\n"
 
         github_url = issue.domain.github.replace("https", "git").replace("http", "git") + ".git"
         from giturlparse import parse as parse_github_url
@@ -223,7 +229,12 @@ def create_github_issue(request, id):
                 [request.user.email],
                 fail_silently=True,
             )
-            return JsonResponse({"status": "Failed", "status_reason": f"Failed: error is {e}"})
+            return JsonResponse(
+                {
+                    "status": "Failed",
+                    "status_reason": "Failed to create GitHub issue. Please check your GitHub settings.",
+                }
+            )
     else:
         return JsonResponse(
             {