Problem/Motivation

This meta is for making sense of the many issues related to link and Url validation and making a plan to fix those issues.

Following is a list of issues gathered from following related issues of #3151047: Expand LinkWidget test coverage and web searches, some of these are for Drupal 7. They are split into two loose groups, ones that focused on validation and one that adds features and validation.

Validation:

Add features:

Other:

Drupal 7 only

This all began from Bug Smash Initiative work #3151047: Expand LinkWidget test coverage.

Steps to reproduce

Proposed resolution

- more to add -

Remaining tasks

TBD

User interface changes

API changes

Data model changes

Release notes snippet

Comments

quietone created an issue. See original summary.

quietone’s picture

quietone commented

#295021: Expand/augment UrlHelper::isValid() to improve correctness and handle more URL types
for Drupal 7. The list of valid and invalid URLs is not as extensive as the list in #3151047: Expand LinkWidget test coverage which was obtained from
https://cran.r-project.org/web/packages/rex/vignettes/url_parsing.html. Therefor it does not offer anything for a Drupal 8 solution. I don't know about Drupal 7, so leaving as is.

#1657886: Filter "Convert URLs into links" doesn't support multilingual web addresses
For Drupal 7. TBD

#1783278: Scheme-relative URL rejected by validation
This is adding support for scheme-relative URLs

#2474191: UrlHelper::isValid() should handle hyphens, '-', correctly
This patch adds code to tests for one case, URLs with '-' in the wrong place.

        '-',
        '-example.com',
        'example-.com',
        'example.-com',
        'example.com-',

Need to check this with the current list and determine if any of these need to be added. see #3151047: Expand LinkWidget test coverage

#2646744: \Drupal\Core\Url does not accept root-relative (file) URLs, making it impossible to let LinkGenerator create root-relative file URL links
This is about files

#3045484: Add support for Internationalized Domain Names (IDN)
Compare the checks done in this issue with the changes done in #3151047: Expand LinkWidget test coverage

#2215915: Support scheme-relative URLs
For Drupal 7. TBD

#389278: Create IDN encoding and decoding functions
This task has been created as a central place to develop the IDN/Punycode encode and decode functions.

#2031149: Add support for additional protocols in Link field definition
Provides ability to add custom protocols.

#2652236: Insufficient link validation for external URLs in link widget
Suggests adding validation for punycode and magnet links in /core/modules/link/src/Plugin/Validation/Constraint/LinkExternalProtocolsConstraintValidator and using Symfony Url Validator.

#2691099: Improve external URL validation in many ways
Suggests adding validation for punycode, protocol relative URLs, and using symfony UrlValidator.

Edit: Fix an issue number, s/33/3/

quietone’s picture

quietone commented
Issue summary: View changes

There are two issues suggesting the use of Symfony UrlValidator. That looks like a topic for one issue, to decide if that should be used.

quietone’s picture

quietone commented
Issue summary: View changes

#2474191: UrlHelper::isValid() should handle hyphens, '-', correctly These values shown in the previous comment are not checked in LinkItemUrlValidationTest

quietone’s picture

quietone commented
Issue summary: View changes

These seems to duplicates. #1783278: Scheme-relative URL rejected by validation has more recent work, yet in 2014 sun said, 2195983-#14, that #2195983: Support scheme-relative URLs is preferred for reasons explained in that comment. Need to examine both patches further.

quietone’s picture

quietone commented
Issue summary: View changes

Found another similar issue. #2935307: Link field doesn't sufficiently validate input

quietone’s picture

quietone commented
Issue summary: View changes

#3045484: Add support for Internationalized Domain Names (IDN) - is using the Symfony Url validator in UrlHelper.

quietone’s picture

quietone commented
Issue summary: View changes
quietone’s picture

quietone commented
Issue summary: View changes

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

quietone’s picture

quietone commented
Issue summary: View changes

Found another issue to add to this meta

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented
Issue summary: View changes

Added #3441637: Separate out validation in Url::fromUri().

dcam’s picture

dcam commented

PHP 8.5 introduces a new always-available Uri extension for parsing and manipulating URIs. Ref:

It's possible that we may be able to replace some of our custom URL parsing and validation with the new extension. This could start during the Drupal 12 lifecycle if we maintain our policy of requiring the most recently released version of PHP. My hope is that it would allow us to close many of these issues that remain open.

As the Link module maintainer this effort would impact the work that I'm doing. So I'm willing to take the lead on the project.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.