fix(review): open-redirect + btoa + honest duplicate-mode txn #249

2026-07-12T22:14:30Z

jmiller commented

2026-07-12 22:14:30 +00:00

Pre-release review fixes (open-redirect via backslash, btoa UTF-8 safety, duplicate-mode non-transactional honesty).

https://claude.ai/code/session_01WbGBN9VyRK61zczYWcCQ2i

Pre-release review fixes (open-redirect via backslash, btoa UTF-8 safety, duplicate-mode non-transactional honesty). https://claude.ai/code/session_01WbGBN9VyRK61zczYWcCQ2i

jmiller added 1 commit 2026-07-12 22:14:30 +00:00

@

Universal: Pre-Release / Build Pre-Release (${{ inputs.stability || github.ref_name }}) (push) Successful in 16s

Details

Generic: Project CI / Lint & Validate (pull_request) Has been cancelled

Details

Universal: PR Check / Branch Policy (pull_request) Has been cancelled

Details

Universal: PR Check / Require Docs Update (pull_request) Has been cancelled

Details

Universal: PR Check / Wiki Update Reminder (pull_request) Has been cancelled

Details

Universal: PR Check / Secret Scan (pull_request) Has been cancelled

Details

Universal: PR Check / Validate PR (pull_request) Has been cancelled

Details

Joomla: Metadata Validation / Validate Joomla Metadata (pull_request) Has been cancelled

Details

Generic: Project CI / Tests (pull_request) Has been cancelled

Details

Universal: PR Check / Build RC Package (pull_request) Has been cancelled

Details

Universal: PR Check / Report Issues (pull_request) Has been cancelled

Details

f9c1c6b186

fix(review): open-redirect, btoa UTF-8 safety, honest duplicate-mode txn

Pre-release review findings on dev -> main:

- Return-URL open-redirect (MED): a base64 returnurl like "/\evil.com"
  passed the root-relative allow-list (raw[1] is "\", not "/"), and a
  browser normalises leading "/\" to "//", yielding a protocol-relative
  redirect off-site. Reject any backslash or control char in the decoded
  return URL outright — legitimate Joomla admin URLs never contain them.

- installer-backup.js btoa() (LOW): btoa() throws on non-Latin1 input
  (e.g. a UTF-8 filter value in the list query string), and the throw was
  uncaught after preventDefault(), leaving the toolbar button dead. Build
  the redirect (UTF-8-safe base64) BEFORE swallowing the click; if it
  still fails, bail without preventing so Joomla proceeds normally.

- Snapshot duplicate-mode transaction (HIGH): restore() wrapped duplicate
  mode in transactionStart()/Rollback(), but duplicate mode writes via
  Joomla Table API whose Nested tables (categories/tags) issue LOCK
  TABLES, which implicitly COMMITS the open transaction in MySQL — so the
  rollback promise was illusory and a mid-inject failure left a slave
  half-updated. Run only the raw-DB modes (replace/create/merge) inside
  the transaction; duplicate mode runs outside it, matching its existing
  per-item defensive design (bad item skipped + logged, never fatal).

Claude-Session: https://claude.ai/code/session_01WbGBN9VyRK61zczYWcCQ2i
@

jmiller added 1 commit 2026-07-12 22:14:31 +00:00

chore(version): pre-release bump to 02.58.36-dev [skip ci]

Branch Cleanup / Delete merged branch (pull_request) Has been cancelled

Details

RC Revert / Rename rc/ back to dev/ (pull_request) Has been cancelled

Details

498f62e975

jmiller merged commit 7a7e804647 into dev

2026-07-12 22:14:44 +00:00

jmiller deleted branch fix/prerelease-review

2026-07-12 22:14:45 +00:00

Sign in to join this conversation.

Priority -

Type -

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuiteBackup#249