Ask HN: please review my tool for rewrite rule testing | Hacker News Reader

Ask HN: please review my tool for rewrite rule testing

martinmelin.se

32 pointsmmelin13 comments

I tried it with the WordPress rewrites ( http://codex.wordpress.org/Using_Permalinks ) and I couldn't get it to work. I think the problem is that I didn't know what to put in REQUEST_FILENAME. I tried the following:

REQUEST_FILENAME: I tried blank, "year/month/day/post-name" and "/year/month/day/post-name".

URL: year/month/day/post-name (to give hostname/year/month/day/post-name).

Rewrite rules copied from the WP link above:

  # BEGIN WordPress
  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /index.php [L]
  </IfModule>
  # END WordPress

I got one no match and two rules skipped.

EDIT: You have an XSS vulnerability in the URL field. Use the first test from this list: http://ha.ckers.org/xss.html .

Thanks! I've realized I need to come up with a better way to handle the special RewriteCond patterns, such as -f and -d. Right now all variables are handled in the same naive way, i.e. you get to specify their value in text form, but for things like -f/d/l that doesn't work (because for instance -f tests if the input string is a file in the current directory)

The RewriteRules are also vulnerable to XSS. Try entering

  RewriteRule . /index.php<script>alert(document.location)</script> [L]

and submitting a URL.

Very handy - worked well for a couple of simple rules; it'd be good to see more feedback when it can't handle something (e.g. feeding it the rules from http://stackoverflow.com/questions/992565/why-isnt-this-rewr... just results in a greyed-out URL field).

Trivial nit: backslashes are doubled when rules are restored from the session.

Thanks for the feedback, should have a fix up shortly for the backslash problem and will try to improve error handling in the UI some more. That SO thread looks like a great resource for gnarly rulesets to test :)

Haven't actually tried it, but anything that helps with mod_rewrite is gonna be useful :)

Wow, this is a great idea! One idea, maybe add a small disclaimer or something at the bottom stating that any saved rewrite rules are private - rewrite rules often contain paths to scripts/pages on the filesystem that many people would never wish to reveal to the public. Or, make the storage functionality optional so real privacy freaks can turn it off.

I will definitely use this next time I have to hack 'n slash some rewrite rules though!

Very useful indeed, thanks!

I'm missing one important feature though: there is no way to test different host names. I use rewrite rules that check country specific TLDs on the domain name and also rules that check if the domain starts with "m." for mobile specific access by matching against %{HTTP_HOST}. This would also allow one to check if the URL is using an IP address instead of a domain name. This would seem a common need, right?

I tried this and an extra field appeared above the URL allowing me to specify a value for HTTP_HOST.

Yep, and what should happen is that when you enter a ruleset that uses a %{VARIABLE}, a text field should appear to let you specify the value to use for testing. If this does not happen for you, would you mind using the problem report button on the site? It will let me see your ruleset and a debug log to troubleshoot.

Had quick run at it and it seems to work nicely. I spend half my life dealing with rewrites of varying complexity so this might well save me some time!

It would be great if you would allow for multiple test URLs, i.e. make the “Enter a URL” input field a textarea that accepts a new URL on every line.

Another suggestion: why not just use localStorage instead of a $_SESSION?

Its definitely going to make my life with debugging mod_rewrite rules so much easier. Thanks =D

Reply on news.ycombinator.com