| 1.
With "No external links" selected, links to https site don't work. In
previous versions, the "https://" and "http://" from URLs were removed. Now
it seems just "http://" is removed. It almost works! :)
example - <https://secure.foo.com/>
result - external.html?link=https://secure.foo.com/
external.html - <http://https//secure.foo.com/>
2.
Issue with /../ URLs. Imagine the page <http://foo.com/page.htm> has the
following links. If the link starts with / and then incorrectly points to a
level ABOVE that (using ../), the final captured page will also try to go back
that far.
<a href="../../../">Restricted</a>
<a href="/../../">Not restricted</a>
<a href="/folder/../../">Not restricted</a>
Those links result in:
- external.html?link=foo.com/
- C:\my web sites\myProject\
- C:\my web sites\
A link on a webpage should not be allowed to point higher than its base
domain, eg: foo.com/
| |