search

hiviah / https-everywhere-checker

Obsolete, upkept version at EFF
https://github.com/EFForg/https-everywhere/tree/master/test/rules
GNU General Public License v3.0
19 stars 16 forks source link

Target matching semantics are subtly different than HTTPS Everywhere #13

Open jsha opened 9 years ago

jsha commented 9 years ago

Specifically, in HTTPS Everywhere, right-wildcards don't match arbitrarily deep (unlike left wildcards, which do). Specifically, google.* will match google.com but not google.com.au. However, I think https-everywhere-checker does match arbitrarily deep. We should fix this to match the HTTPS Everywhere behavior, which is intentional.

Up until recently this was a little ambiguous on https://www.eff.org/https-everywhere/rulesets, so I've updated it to clarify.

hiviah commented 9 years ago

Actually this has been implemented before in RuleTrie.transformUrl when looking for applicable rulesets. Since pull request #4 the matching on target is bypassed - UrlComparisonThread.processUrl tests all regexps in the ruleset (may match hosts that are not listed in element).

jsha commented 9 years ago

Ah, good point - thanks for spotting it. I will fix that code to reject URLs that don't match the targets.