Problem/Motivation

The Webform contextual link JavaScript currently removes destination query parameters by splitting the link URL string. This should be made more defensive so the behavior only rewrites same-origin Webform contextual links and leaves unrelated links unchanged.

This was originally reported through the security issue process by zenphp and was reviewed/cleared for public follow-up.

Steps to reproduce

  1. Use a Webform page with contextual links available.
  2. Trigger the contextual link behavior.
  3. Compare how same-origin Webform contextual links and non-Webform or external links are rewritten.

Proposed resolution

Parse contextual link href values as URLs, only rewrite same-origin links, remove query strings from accepted links, and keep the existing Webform test-route rewrite behavior.

The attached original patch adds a FunctionalJavascript regression test for the intended same-origin rewrites and for links that should not be rewritten.

Remaining tasks

  • Review the attached patch.
  • Confirm test coverage and coding standards.

User interface changes

None.

API changes

None.

Data model changes

None.

CommentFileSizeAuthor
webform-183418-comment-14.patch5 KBjrockowitz

Issue fork webform-3611236

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

jrockowitz created an issue.

jrockowitz opened merge request !900