Skip to content

Don't crawl actions again after being redirected to them#2557

Merged
labkey-tchad merged 1 commit intorelease25.7-SNAPSHOTfrom
25.7_fb_trackCrawlerRedirects
Jul 12, 2025
Merged

Don't crawl actions again after being redirected to them#2557
labkey-tchad merged 1 commit intorelease25.7-SNAPSHOTfrom
25.7_fb_trackCrawlerRedirects

Conversation

@labkey-tchad
Copy link
Member

Rationale

.lastFilter parameter can apply injection parameters when the crawler doesn't expect them.
The crawler would navigate to mothership-begin.view, which redirects to mothership-showExceptions.view. Then it would throw a bunch of injection parameters at mothership-showExceptions.view. The injection checker expects to hit some non-fatal errors, and knows how to evaluate them.
Later, it would crawl mothership-showExceptions.view?.lastFilter=true which would apply the bad parameters to the view. The non-injection phase of the crawler is more strict about what sort of product behavior it expects and might error out when it hits something the injector was fine with.

java.lang.RuntimeException: Crawler threw IllegalArgumentException.
Target page: _mothership/mothership-showExceptions.view?.lastFilter=true
Originating page: http://localhost:8111/_mothership/mothership-showExceptions.view?.lastFilter=true
Target Page: _mothership/mothership-showExceptions.view?.lastFilter=true
Redirected to: http://localhost:8111/_mothership/mothership-showExceptions.view?query.sort=%22%3E%27%3E%27%22%3Cscript%3Ealert(%278(%27)%3C%2Fscript%3E&userId=&returnUrl=&query.name~contains=&rowid=&query.rowid~eq=&name=
  at org.labkey.test.util.Crawler.crawlLink(Crawler.java:1129)
  at org.labkey.test.util.Crawler.crawl(Crawler.java:838)
  at org.labkey.test.util.Crawler.crawlAllLinks(Crawler.java:801)

Related Pull Requests

  • N/A

Changes

  • Don't crawl actions again after being redirected to them

`.lastFilter` parameter can apply injection parameters when the crawler doesn't expect them
@labkey-tchad labkey-tchad merged commit 104debd into release25.7-SNAPSHOT Jul 12, 2025
8 checks passed
@labkey-tchad labkey-tchad deleted the 25.7_fb_trackCrawlerRedirects branch July 12, 2025 14:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants