Ask HN: please review my tool for rewrite rule testing

Re:Ask HN: please review my tool for rewrite rule testing by pierrefar on Wednesday December 29, 2010 @09:01AM (#2048685)

I tried it with the WordPress rewrites ( http://codex.wordpress.org/Using_Permalinks ) and I couldn't get it to work. I think the problem is that I didn't know what to put in REQUEST_FILENAME. I tried the following:

REQUEST_FILENAME: I tried blank, "year/month/day/post-name" and "/year/month/day/post-name".

URL: year/month/day/post-name (to give hostname/year/month/day/post-name).

Rewrite rules copied from the WP link above:

  # BEGIN WordPress
  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /index.php [L]
  </IfModule>
  # END WordPress

I got one no match and two rules skipped.

EDIT: You have an XSS vulnerability in the URL field. Use the first test from this list: http://ha.ckers.org/xss.html .

[ Parent | on HN ]

Re:Ask HN: please review my tool for rewrite rule testing by mmelin on Wednesday December 29, 2010 @10:12AM (#2048837)

Thanks! I've realized I need to come up with a better way to handle the special RewriteCond patterns, such as -f and -d. Right now all variables are handled in the same naive way, i.e. you get to specify their value in text form, but for things like -f/d/l that doesn't work (because for instance -f tests if the input string is a file in the current directory)

[ Parent | on HN ]

Re:Ask HN: please review my tool for rewrite rule testing by nbpoole on Wednesday December 29, 2010 @10:42AM (#2048952)

The RewriteRules are also vulnerable to XSS. Try entering

  RewriteRule . /index.php<script>alert(document.location)</script> [L]

and submitting a URL.

[ Parent | on HN ]