Closed (fixed)
Project:
Email Domain Validate MXR
Version:
7.x-1.x-dev
Component:
Code
Priority:
Normal
Category:
Support request
Assigned:
Reporter:
Created:
16 Jan 2019 at 23:44 UTC
Updated:
22 Nov 2023 at 10:34 UTC
Jump to comment: Most recent
Comments
Comment #2
heddnhttps://cgit.drupalcode.org/sandbox-pbrown063-3026144/tree/LICENSE.txt => remove as the d.o packager adds this.
https://cgit.drupalcode.org/sandbox-pbrown063-3026144/tree/email_domain_... and https://cgit.drupalcode.org/sandbox-pbrown063-3026144/tree/email_domain_... => markup shouldn't be used in translatable strings. That makes it really confusing for translators.
https://cgit.drupalcode.org/sandbox-pbrown063-3026144/tree/email_domain_... => email_domain_validate_mxr_disable => Try deleting things using a wildcard. What if this optional module gets enabled, then later disabled while this module remains configured? We'd have stray variables.
https://cgit.drupalcode.org/sandbox-pbrown063-3026144/tree/email_domain_... => I think this allows for JS nastiness as we don't sanitize the domain. What if that is some juicy XSS?
Comment #3
pbrown063 commentedLucas, each of the flags that you raised are resolved by the following set of commits:
remove as the d.o packager adds this.
https://git.drupalcode.org/sandbox/pbrown063-3026144/commit/09ed73b
markup shouldn't be used in translatable strings. That makes it really confusing for translators.
https://git.drupalcode.org/sandbox/pbrown063-3026144/commit/2afb30c
https://git.drupalcode.org/sandbox/pbrown063-3026144/commit/53833d7
Try deleting things using a wildcard.
https://git.drupalcode.org/sandbox/pbrown063-3026144/commit/61f8359
What if that is some juicy XSS?
https://git.drupalcode.org/sandbox/pbrown063-3026144/commit/f766ce7
Comment #4
pbrown063 commentedComment #5
pbrown063 commentedComment #7
avpaderno