yext / answers-hitchhiker-theme

9%

master: 9%

LAST BUILD ON BRANCH jronkin/referrrerpageurl-encoding-fix

branch: jronkin/referrrerpageurl-encoding-fix

CHANGE BRANCH

x

Reset

• jronkin/referrrerpageurl-encoding-fix
• connor-demo
• dev/add-gda-to-all-vertical-templates
• dev/drop-version
• dev/gda-allow-custom-link-field
• dev/gda-card
• dev/gda-card-generator
• dev/test-reusable-workflows
• develop
• early-access-fall-22
• early-access-spring-22
• early-access-summer-21
• early-access-winter-21
• feature/add-translations
• feature/allow-all-sdk-branches
• feature/arabic-test
• feature/boolean-translations
• feature/card-visual-tests
• feature/case-deflection
• feature/css-nano
• feature/day-translations
• feature/feedback-buttons
• feature/icon-partial
• feature/iframe-wcag
• feature/jwt-support
• feature/jwt-support-merge
• feature/open-status-translations
• feature/optimize-babel-helper
• feature/remove-sass-warnings
• feature/remove-utility-layout
• feature/slaphot-reusable-workflow
• feature/support-iframe-mic
• feature/test-infra-fixes
• feature/update-deps
• feature/video-card-analytics
• feature/visitor-and-auth
• feature/webpack-optimizations
• fix
• fix-faq-answer
• gda-develop
• hotfix/v1.22.1
• hotfix/v1.22.2
• hotfix/v1.22.3
• hotfix/v1.23.1
• hotfix/v1.24.1
• hotfix/v1.27.1
• hotfix/v1.28.1
• hotfix/v1.29.1
• hotfix/v1.29.2
• hotfix/v1.29.3
• hotfix/v1.29.4
• hotfix/v1.29.5
• hotfix/v1.30.1
• hotfix/v1.33.1
• hotfix/v1.33.2
• hotfix/v1.33.3
• hotfix/v1.33.4
• hotfix/v1.33.5
• hotfix/v1.33.6
• hotfix/v1.33.7
• hotfix/v1.33.8
• hotfix/v1.34.1
• hotfix/v1.34.2
• hotfix/v1.34.3
• hotfix/v1.34.4
• hotfix/v1.34.5
• hotfix/v1.35.1
• hotfix/v1.35.2
• hotfix/v1.35.3
• hotfix/v1.35.4
• hotfix/v1.35.5
• jronkin/dateRange-end-format-fix
• master
• playwright
• prep-v1.33.0
• release/test
• release/v1.22
• release/v1.24
• release/v1.25
• release/v1.26
• release/v1.27
• release/v1.28
• release/v1.29
• release/v1.30
• release/v1.34.0
• resolve-conflicts/v1.28.1
• revert-1022-release/v1.27
• revert-1026-revert-1022-release/v1.27
• revert-970-dev/visitor-support
• richtext-v2-changes
• semgrep-ubuntu-latest
• snyk-upgrade-14c5113a8be15ca02502b1b821601cf4
• snyk-upgrade-15ec3e648c89673110cfb44c4f903ecb
• snyk-upgrade-1de187bd42cad5518972d28887767a65
• snyk-upgrade-1ed7701b7f79f070c558e26767848480
• snyk-upgrade-23ccae2026e31701d75139ed317d194e
• snyk-upgrade-2dec84990f7c71cc7862425b6476f2fe
• snyk-upgrade-4f391093ff46d68a94ffe25e19168893
• snyk-upgrade-91a311467c432f1f13dffe42f829fb16
• snyk-upgrade-c8514ff670a9fbb5df82693e088362b0
• snyk-upgrade-cd20c6e3eac6eed26d2601763c219fdc
• snyk-upgrade-d32819b223787ba7c46cfb8c46366d54
• techops9902
• test-acceptance
• theme-upgrade-v1.30_jacob

Build # 6354055890

Build Type

Pull #1152

github

Committed by web-flow

Commit Message

fix(iframe-common.js): properly encode referrerPageUrl param

Currently, referrerPageUrl is added as a query param value without being escaped. That can cause problems on sites with tighter security restrictions. We faced this problem on several sites such as this one: https://yexttest.atlassian.net/browse/PC-208916

It can also cause functional problems when the referrer URL has query parameters. For example, a URL of http://example.com?a=1&b=2 will lead to https://answers.example.com?query=TEST&referrerPageUrl=http://example.com?a=1&b=2

In that example, &b=2 will be treated as a query parameter of the  results page URL instead of being part of the referrerPageUrl value.

Pull Request Pull Request #1152: fix(iframe-common.js): properly encode referrerPageUrl param

Run Details

267 of 3128 branches covered (0.0%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

492 of 5559 relevant lines covered (8.85%)

0.66 hits per line