Title: Sharerich issues with javascript in Whatsapp widget

Problem/Motivation

sharerich.services.yml redefines the
filter_protocols container parameter to add
whatsapp and javascript:

parameters:
  filter_protocols:
    - http
    ...
    - whatsapp
    - javascript

filter_protocols is not module-scoped. It is the site-wide and
src attributes, which in turn is what Drupal's text formats use.
Redefining it here means
>Sharerich stops filtering
javascript: URLs >.

Proposed resolution

Remove the parameters: block from
sharerich.services.yml entirely.

It is not needed. The two buttons that want those protocols are Print
(javascript:window.print()) and WhatsApp
(whatsapp://send?...), and js/sharerich.js already
restores both on the client:

restoreProtocol(link, 'window', 'javascript:');
restoreProtocol(link, '//send', 'whatsapp:');

Those workarounds exist precisely because Drupal strips the protocols
server-side, so the module has been carrying both a global override and a
client-side fallback. Dropping the override leaves the fallback doing the job
it was written for.

The only loss is that Print and WhatsApp stop working for visitors with
JavaScript disabled. A follow-up could drop the javascript: URL from the
Print button altogether and bind a click handler instead.

Comments

marcelovani created an issue. See original summary.

  • marcelovani committed d787fac2 on 8.x-1.x
    Issue #3619610: Stop overriding the site-wide protocol allow list...
marcelovani’s picture

Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.