WordPress.org

Make WordPress Core

Opened 6 months ago

Last modified 6 months ago

#53362 new defect (bug)

Invalid paginated requests not treated as such

Reported by: daleharrison Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 5.7.2
Component: Canonical Keywords:
Focuses: Cc:

Description

This is a follow-up to #40773.

The security department that scans our WordPress websites identified the issue resolved in #40773 as cross-site scripting, as our themes add the webpage's precise URL to Open Graph data (og:url) in the <head>.

So, we were happy to see the resolutions applied in that ticket. Unfortunately, while testing, we found that adding /0/ to any URL is still possible, e.g. https://example.com/about-us/0/ does not redirect back to the canonical https://example.com/about-us/.

Additionally, we have found that it is possible to append /page/ followed by a number to the URL of a page that does not support pagination, e.g. https://example.com/about-us/page/0/, https://example.com/about-us/page/12345/, etc.

In the latter example, the <title> also changes from "About Us" to "About Us – Page 12345" as WordPress seems to think this is a valid paginated page. The paged-12345 and page-paged-12345 classes are also added to the <body>. These specific tests were done using the Twenty Twenty-One theme.

Furthermore, appending /page/0/ to the page that displays blog posts does not trigger a 404 or a redirect, e.g. https://example.com/blog/ is "identical" to https://example.com/blog/page/0/.

Change History (2)

#1 @henry.wright
6 months ago

Last edited 6 months ago by henry.wright (previous) (diff)

#2 @SergeyBiryukov
6 months ago

Hi there, welcome back to WordPress Trac! Thanks for the report.

Additionally, we have found that it is possible to append /page/ followed by a number to the URL of a page that does not support pagination, e.g. https://example.com/about-us/page/0/, https://example.com/about-us/page/12345/, etc.

Just noting that this part of the ticket is already being tracked in #28081.

Note: See TracTickets for help on using tickets.