github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #849] Hyperlinks with a "&" character get a slash prefix #582

New issue

Closed

opened 2026-05-05 06:12:56 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 06:12:56 -06:00

Owner

Originally created by @boltronics on GitHub (Oct 9, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/849

This used to be an issue back in https://github.com/netblue30/firejail/issues/382 which was fixed.

At some point after that patch made it upstream, I switched over to builds from Debian and just assumed they would eventually catch up to a release that had the fix... but it's been months and nothing. So I went back to look at this again and compare the Debian package source to see if they were missing the the magic 834c420f2f commit. It looks like that code has been completely re-factored and this issue was probably not considered.

So it seems this bug is back again. As an example, if I click on the link http://some.domain.com/track/click?u=8c91a39196d452fc8446b9e62&id=842d1ac1ba&e=5fe430865d in my mail client, firejail will turn this into http://some.domain.com/track/click?u=8c91a39196d452fc8446b9e62\&id=842d1ac1ba\&e=5fe430865d when sent as an argument to my web browser, which generally returns an error. I get a lot of e-mail that has these kind of links, so this is a daily annoyance for me. :)

Thanks.

Originally created by @boltronics on GitHub (Oct 9, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/849 This used to be an issue back in https://github.com/netblue30/firejail/issues/382 which was fixed. At some point after that patch made it upstream, I switched over to builds from Debian and just assumed they would eventually catch up to a release that had the fix... but it's been months and nothing. So I went back to look at this again and compare the Debian package source to see if they were missing the the magic https://github.com/netblue30/firejail/commit/834c420f2f97e4bfa48c528380f2c18b0261a6e5 commit. It looks like that code has been completely re-factored and this issue was probably not considered. So it seems this bug is back again. As an example, if I click on the link `http://some.domain.com/track/click?u=8c91a39196d452fc8446b9e62&id=842d1ac1ba&e=5fe430865d` in my mail client, firejail will turn this into `http://some.domain.com/track/click?u=8c91a39196d452fc8446b9e62\&id=842d1ac1ba\&e=5fe430865d` when sent as an argument to my web browser, which generally returns an error. I get a lot of e-mail that has these kind of links, so this is a daily annoyance for me. :) Thanks.

gitea-mirror

2026-05-05 06:12:56 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 06:13:02 -06:00

Author

Owner

@manevich commented on GitHub (Oct 9, 2016):

@boltronics
Just installed IceDove and tried to reproduce this bug.
But everything works fine for me on Debian Stable, with Firefox 45.4.0esr-1~~deb8u2 and IceDove 45.3.0-1~~deb8u1. Both with Firejail 0.9.42-1~bpo8+1 and git version.
Which versions you are using?

P.S: I am one that re-factored cmdline quoting code.

@manevich commented on GitHub (Oct 9, 2016): @boltronics Just installed IceDove and tried to reproduce this bug. But everything works fine for me on Debian Stable, with Firefox 45.4.0esr-1~deb8u2 and IceDove 45.3.0-1~deb8u1. Both with Firejail 0.9.42-1~bpo8+1 and git version. Which versions you are using? P.S: I am one that re-factored cmdline quoting code.

gitea-mirror commented

2026-05-05 06:13:03 -06:00

Author

Owner

@boltronics commented on GitHub (Oct 10, 2016):

I'm running Debian Stretch at home, which currently ships 0.9.42-1.

Strangely, when I try from work which runs Debian Jessie and 0.9.42-1~bpo8+1, I don't have this problem. I don't know why Jessie doesn't show the issue but Stretch does, at least for me.

Actually... looking over everything again as I write this, I think I see something that looks related however. I do have a wrapper script that I have been using ever since I started using firejail (which I just posted over at https://github.com/boltronics/jail and will have to document to make its function clearer).

Of particular interest is line 144 where I do manually slash out the & character. This appears to still be required for Jessie for URLs to work... I'll have to look into this closer when I get home as I'm not sure it's related.

@boltronics commented on GitHub (Oct 10, 2016): I'm running Debian Stretch at home, which currently ships [0.9.42-1](https://packages.debian.org/stretch/firejail). Strangely, when I try from work which runs Debian Jessie and [0.9.42-1~bpo8+1](https://packages.debian.org/jessie-backports/firejail), I don't have this problem. I don't know why Jessie doesn't show the issue but Stretch does, at least for me. Actually... looking over everything again as I write this, I think I see something that looks related however. I do have a wrapper script that I have been using ever since I started using firejail (which I just posted over at https://github.com/boltronics/jail and will have to document to make its function clearer). Of particular interest is [line 144](https://github.com/boltronics/jail/blob/master/bin/jail#L144) where I do manually slash out the `&` character. This appears to still be required for Jessie for URLs to work... I'll have to look into this closer when I get home as I'm not sure it's related.

gitea-mirror commented

2026-05-05 06:13:05 -06:00

Author

Owner

@manevich commented on GitHub (Oct 10, 2016):

Slashing out & character on lines 140 and 144 in your script is obviously workaround for problem that already fixed in current versions of Firejail in Debian (0.9.42-1 and 0.9.42-1~bpo8+1).
Removing it should fix this bug.

@manevich commented on GitHub (Oct 10, 2016): Slashing out `&` character on lines 140 and 144 in your script is obviously workaround for problem that already fixed in current versions of Firejail in Debian (0.9.42-1 and 0.9.42-1~bpo8+1). Removing it should fix this bug.

gitea-mirror commented

2026-05-05 06:13:07 -06:00

Author

Owner

@boltronics commented on GitHub (Oct 11, 2016):

Thanks @manevich. I intended to give it a try last night at home, but forgot.

In the meantime I have removed that escaping from the script (as seen here) on my Jessie desktop at work and it surprisingly still seems to function correctly. Strange that it's only a problem in one environment and not the other, if that is the cause.

But I think you are probably right. I'll try to test that change on Stretch tonight.

@boltronics commented on GitHub (Oct 11, 2016): Thanks @manevich. I intended to give it a try last night at home, but forgot. In the meantime I have removed that escaping from the script (as seen [here](https://github.com/boltronics/jail/blob/remove_amper_escaping/bin/jail#L144)) on my Jessie desktop at work and it surprisingly still seems to function correctly. Strange that it's only a problem in one environment and not the other, if that is the cause. But I think you are probably right. I'll try to test that change on Stretch tonight.

gitea-mirror commented

2026-05-05 06:13:09 -06:00

Author

Owner

@boltronics commented on GitHub (Oct 11, 2016):

Tested, and that was the cause. Sorry for the noise.

@boltronics commented on GitHub (Oct 11, 2016): Tested, and that was the cause. Sorry for the noise.

gitea-mirror commented

2026-05-05 06:13:11 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 11, 2016):

No problem.

@netblue30 commented on GitHub (Oct 11, 2016): No problem.

gitea-mirror referenced this issue

2026-05-05 10:05:44 -06:00

[PR #582] [CLOSED] . #3671

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#582

No description provided.

Rows
Columns