Prevent aliases from starting with a dot [#3398583]

Problem/Motivation

Nodes become inaccessible (403 HTTP code) when using a token which will generate a pattern starting with a dot.

Steps to reproduce

Create an alias pattern with the title of the node as token for all content types
Make sure that the "strings to remove" setting at /admin/config/search/path/settings has at least "a" in it to be removed
Create a node with the title "A.Foo"
The alias will be ".foo"
In many well configured webservers this will result in a 403 HTTP code as the webserver prevents loading hidden files (which start with a dot)

Proposed resolution

Check that an alias can't start with a dot.

I'm not sure if this should be a setting or not. I can't find any reason (yet) why you really want to have an alias starting with a dot but if someone got a case, it should become a setting to disable removing a starting dot.

Comment	File	Size	Author
#3	pathauto_test.png	72.89 KB	sijumpk
#2	remove-starting-dots.patch	494 bytes	rik wijnen

Issue fork pathauto-3398583

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

3398583-prevent-aliases-from changes, plain diff MR !148
Check out this branch for the first time

Check out existing branch, if you already have it locally

About issue forks

Comments

Comment #1

2 November 2023 at 07:05

Rik Wijnen created an issue. See original summary.

Comment #2

rik wijnen commented 2 November 2023 at 07:10

Status	File	Size
new	remove-starting-dots.patch	494 bytes

Patch added which could fix this.

Comment #3

sijumpk commented 4 December 2023 at 10:35

Status	File	Size
new	pathauto_test.png	72.89 KB

Tried creating a node (without applying patch) with title "A.Foo" and the resulted url is /afoo, as expected. "a" is there in the "strings to remove" list while doing this. It seems like all dots are getting replaced irrespective of its position. Its done inside AliasCleaner::cleanString method. Is it just me who cannot reproduce this problem?

Comment #4

meeni_dhobale commented 4 December 2023 at 11:56

I also tried to reproduce this issue without applying the patch with title "A.Foo" and my URL is "/afoo". I didn't see any kind of 403 HTTP code. I am also not able to reproduce this issue.

Comment #5

rik wijnen commented 24 January 2024 at 13:42

I'm sorry, I realize that I was forgotten one setting;
In step 2, you have to select "no action (do not replace)" for "period (.)" in the "punctuation" section of /admin/config/search/path/settings too to make it break.

If you make sure "a" is in the list AND dots must not be replaced, a node with title "A.Foo" will result in url ".foo".

And yes, I'm telling the system to not replace dots but this is a special case because this one will break your site with widely used server configurations. Maybe it should be a setting in the module to prevent urls being starting with a dot, so it can be enabled if your webserver does not allow files and directories to begin with a dot.

Comment #6

mably commented 6 February 2026 at 23:41

Status:

Active

» Needs work

Could we have an MR please?

Comment #7

12 February 2026 at 08:48

mably opened merge request !148

Comment #8

mably commented 12 February 2026 at 09:03

Status:

Needs work

» Needs review

Leading dot removal in path aliases

Problem

When the period punctuation setting is set to "Do nothing", path aliases could start with a dot (e.g. .hidden-page). Leading dots in URL paths create hidden paths that may be blocked by web servers (Apache/Nginx) or cause unexpected behavior.

Changes

AliasCleaner.php: Added ltrim($output, '.') to strip leading dots from cleaned strings, after all other processing (transliteration, punctuation handling,
lowercasing) is complete.
PathautoKernelTest.php: Added kernel test covering leading dot removal with period punctuation set to "do nothing", verifying:
- Single leading dot is stripped (.hidden → hidden)
- Multiple leading dots are stripped (..hidden → hidden)
- Inner dots are preserved (.hidden.file → hidden.file)
- Strings without leading dots are unaffected (normal.file → normal.file)

Design decision

No configuration setting was added. This is an unconditional sanitization step, consistent with other non-configurable cleanups (whitespace replacement, duplicate separator trimming, length truncation).