[wp-trac] [WordPress Trac] #53362: Invalid paginated requests not treated as such

Tue Jun 8 20:38:20 UTC 2021

#53362: Invalid paginated requests not treated as such
--------------------------+-----------------------------
 Reporter:  daleharrison  |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Canonical     |    Version:  5.7.2
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 This is a follow-up to #40773.

 The security department that scans our WordPress websites identified the
 issue resolved in #40773 as cross-site scripting, as our themes add the
 webpage's precise URL to Open Graph data (`og:url`) in the `<head>`.

 So, we were happy to see the resolutions applied in that ticket.
 Unfortunately, while testing, we found that adding `/0/` to any URL is
 still possible, e.g. https://example.com/about-us/0/ does not redirect
 back to the canonical https://example.com/about-us/.

 Additionally, we have found that it is possible to append `/page/`
 followed by a number to the URL of a page that does not support
 pagination, e.g. https://example.com/about-us/page/0/, https://example.com
 /about-us/page/12345/, etc.

 In the latter example, the `<title>` also changes from "About Us" to
 "About Us – Page 12345" as WordPress seems to think this is a valid
 paginated page. The `paged-12345` and `page-paged-12345` classes are also
 added to the `<body>`. These specific tests were done using the Twenty
 Twenty-One theme.

 Furthermore, appending `/page/0/` to the page that displays blog posts
 does not trigger a 404 or a redirect, e.g. https://example.com/blog/ is
 "identical" to https://example.com/blog/page/0/.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/53362>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform