Thanks to visit codestin.com
Credit goes to github.com

fix: url poisoning via user-controlled input (take 4) #700

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

rofe wants to merge 5 commits into main from j33256d

Contributor

rofe commented Dec 16, 2025

Adds back fix for SITES-33256 initially added in #672 and enhanced in #685 and #693
Fixes regression causing revert in #699 by allowing underscores in path segments

https://j33256d--da-live--adobe.aem.page/edit

rofe added 4 commits

December 6, 2025 10:42


          fix: url poisoning via user-controlled input (#672)

893565c


          fix: preserve dots and protect against path traversal

ffb36ab


          fix: retain leading dashes in path parts

fd2bc75


          fix: retain underscores in path parts

acd5269

rofe requested a review from auniverseaway

December 16, 2025 16:43

aem-code-sync bot commented Dec 16, 2025 •

edited

Loading

Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
In case there are problems, just click a checkbox below to rerun the respective action.

Re-run PSI checks
Re-sync branch

Commits

b840ae2 ✅ (latest)
acd5269 ✅
fd2bc75 ❌
ffb36ab ❌
893565c ❌

aem-code-sync bot commented Dec 16, 2025 •

edited

Loading

	Page	Scores	Audits	Google
📱	/edit
🖥️	/edit

rofe changed the title ~~J33256d~~ fix: url poisoning via user-controlled input (take 4)


          Merge branch 'main' into j33256d

b840ae2

aem-code-sync bot deployed to j33256d

December 16, 2025 16:47

View deployment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet