github-starred/firejail

Watch

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-09-11 01:50:46 -06:00

[GH-ISSUE #849] Hyperlinks with a "&" character get a slash prefix #582

New issue

Closed

opened 2026-05-05 06:12:56 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 06:12:56 -06:00

Owner

Originally created by @boltronics on GitHub (Oct 9, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/849

This used to be an issue back in https://github.com/netblue30/firejail/issues/382 which was fixed.

At some point after that patch made it upstream, I switched over to builds from Debian and just assumed they would eventually catch up to a release that had the fix... but it's been months and nothing. So I went back to look at this again and compare the Debian package source to see if they were missing the the magic github.com/netblue30/firejail@834c420f2f commit. It looks like that code has been completely re-factored and this issue was probably not considered.

So it seems this bug is back again. As an example, if I click on the link http://some.domain.com/track/click?u=8c91a39196d452fc8446b9e62&id=842d1ac1ba&e=5fe430865d in my mail client, firejail will turn this into http://some.domain.com/track/click?u=8c91a39196d452fc8446b9e62\&id=842d1ac1ba\&e=5fe430865d when sent as an argument to my web browser, which generally returns an error. I get a lot of e-mail that has these kind of links, so this is a daily annoyance for me. :)

Thanks.

Originally created by @boltronics on GitHub (Oct 9, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/849 This used to be an issue back in https://github.com/netblue30/firejail/issues/382 which was fixed. At some point after that patch made it upstream, I switched over to builds from Debian and just assumed they would eventually catch up to a release that had the fix... but it's been months and nothing. So I went back to look at this again and compare the Debian package source to see if they were missing the the magic https://github.com/netblue30/firejail/commit/834c420f2f97e4bfa48c528380f2c18b0261a6e5 commit. It looks like that code has been completely re-factored and this issue was probably not considered. So it seems this bug is back again. As an example, if I click on the link `http://some.domain.com/track/click?u=8c91a39196d452fc8446b9e62&id=842d1ac1ba&e=5fe430865d` in my mail client, firejail will turn this into `http://some.domain.com/track/click?u=8c91a39196d452fc8446b9e62\&id=842d1ac1ba\&e=5fe430865d` when sent as an argument to my web browser, which generally returns an error. I get a lot of e-mail that has these kind of links, so this is a daily annoyance for me. :) Thanks.

gitea-mirror

2026-05-05 06:12:56 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 06:13:02 -06:00

Author

Owner

@manevich commented on GitHub (Oct 9, 2016):

@boltronics
Just installed IceDove and tried to reproduce this bug.
But everything works fine for me on Debian Stable, with Firefox 45.4.0esr-1~~deb8u2 and IceDove 45.3.0-1~~deb8u1. Both with Firejail 0.9.42-1~bpo8+1 and git version.
Which versions you are using?

P.S: I am one that re-factored cmdline quoting code.

@manevich commented on GitHub (Oct 9, 2016): @boltronics Just installed IceDove and tried to reproduce this bug. But everything works fine for me on Debian Stable, with Firefox 45.4.0esr-1~deb8u2 and IceDove 45.3.0-1~deb8u1. Both with Firejail 0.9.42-1~bpo8+1 and git version. Which versions you are using? P.S: I am one that re-factored cmdline quoting code.

gitea-mirror commented

2026-05-05 06:13:03 -06:00

Author

Owner

@boltronics commented on GitHub (Oct 10, 2016):

I'm running Debian Stretch at home, which currently ships 0.9.42-1.

Strangely, when I try from work which runs Debian Jessie and 0.9.42-1~bpo8+1, I don't have this problem. I don't know why Jessie doesn't show the issue but Stretch does, at least for me.

Actually... looking over everything again as I write this, I think I see something that looks related however. I do have a wrapper script that I have been using ever since I started using firejail (which I just posted over at https://github.com/boltronics/jail and will have to document to make its function clearer).

Of particular interest is line 144 where I do manually slash out the & character. This appears to still be required for Jessie for URLs to work... I'll have to look into this closer when I get home as I'm not sure it's related.

@boltronics commented on GitHub (Oct 10, 2016): I'm running Debian Stretch at home, which currently ships [0.9.42-1](https://packages.debian.org/stretch/firejail). Strangely, when I try from work which runs Debian Jessie and [0.9.42-1~bpo8+1](https://packages.debian.org/jessie-backports/firejail), I don't have this problem. I don't know why Jessie doesn't show the issue but Stretch does, at least for me. Actually... looking over everything again as I write this, I think I see something that looks related however. I do have a wrapper script that I have been using ever since I started using firejail (which I just posted over at https://github.com/boltronics/jail and will have to document to make its function clearer). Of particular interest is [line 144](https://github.com/boltronics/jail/blob/master/bin/jail#L144) where I do manually slash out the `&` character. This appears to still be required for Jessie for URLs to work... I'll have to look into this closer when I get home as I'm not sure it's related.

gitea-mirror commented

2026-05-05 06:13:05 -06:00

Author

Owner

@manevich commented on GitHub (Oct 10, 2016):

Slashing out & character on lines 140 and 144 in your script is obviously workaround for problem that already fixed in current versions of Firejail in Debian (0.9.42-1 and 0.9.42-1~bpo8+1).
Removing it should fix this bug.

@manevich commented on GitHub (Oct 10, 2016): Slashing out `&` character on lines 140 and 144 in your script is obviously workaround for problem that already fixed in current versions of Firejail in Debian (0.9.42-1 and 0.9.42-1~bpo8+1). Removing it should fix this bug.

gitea-mirror commented

2026-05-05 06:13:07 -06:00

Author

Owner

@boltronics commented on GitHub (Oct 11, 2016):

Thanks @manevich. I intended to give it a try last night at home, but forgot.

In the meantime I have removed that escaping from the script (as seen here) on my Jessie desktop at work and it surprisingly still seems to function correctly. Strange that it's only a problem in one environment and not the other, if that is the cause.

But I think you are probably right. I'll try to test that change on Stretch tonight.

@boltronics commented on GitHub (Oct 11, 2016): Thanks @manevich. I intended to give it a try last night at home, but forgot. In the meantime I have removed that escaping from the script (as seen [here](https://github.com/boltronics/jail/blob/remove_amper_escaping/bin/jail#L144)) on my Jessie desktop at work and it surprisingly still seems to function correctly. Strange that it's only a problem in one environment and not the other, if that is the cause. But I think you are probably right. I'll try to test that change on Stretch tonight.

gitea-mirror commented

2026-05-05 06:13:09 -06:00

Author

Owner

@boltronics commented on GitHub (Oct 11, 2016):

Tested, and that was the cause. Sorry for the noise.

@boltronics commented on GitHub (Oct 11, 2016): Tested, and that was the cause. Sorry for the noise.

gitea-mirror commented

2026-05-05 06:13:11 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 11, 2016):

No problem.

@netblue30 commented on GitHub (Oct 11, 2016): No problem.

gitea-mirror referenced this issue

2026-05-05 10:05:44 -06:00

[PR #582] [CLOSED] . #3671

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

github-starred/firejail#582

No description provided.

Rows
Columns