Bug 2035372

[dklawren]

r+ carried over from private pull request

[Copilot]

Pull request overview

This PR hardens handling of the bug “URL” field (bug_file_loc) by preventing unsafe-scheme URLs from being rendered as clickable links and by adding server-side validation that rejects disallowed schemes on create/update (with a dedicated user/webservice error).

Changes:

• Add allowlist-based validation for bug_file_loc (and a new bug_file_loc_invalid user/webservice error) to reject unsafe URL schemes while allowing existing unsafe stored values to remain editable for other fields.
• Update multiple templates (core + InlineHistory + BugModal) to render unsafe bug_file_loc values as plain text rather than clickable links.
• Move SAFE_URL_REGEXP into Bugzilla::Constants and add webservice regression tests for unsafe URL schemes.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
template/en/default/global/user-error.html.tmpl	Adds a user-facing error message for invalid bug_file_loc URLs.
template/en/default/bug/edit.html.tmpl	Stops rendering unsafe bug_file_loc values as clickable links in the edit UI.
qa/t/webservice_bug_create.t	Adds webservice tests asserting unsafe URL schemes are rejected for url.
extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl	Prevents unsafe bug_file_loc values from being linked in inline history output.
extensions/BugModal/web/bug_modal.js	Removes the client-side unsafe-URL click confirmation logic.
extensions/BugModal/template/en/default/bug_modal/edit.html.tmpl	Renders unsafe bug_file_loc as non-clickable text in BugModal edit view.
extensions/BugModal/template/en/default/bug_modal/activity_stream.html.tmpl	Renders unsafe bug_file_loc as non-clickable text in BugModal activity stream.
Bugzilla/WebService/Constants.pm	Adds a webservice error code mapping for bug_file_loc_invalid.
Bugzilla/Template.pm	Removes the local SAFE_URL_REGEXP helper (now sourced from constants).
Bugzilla/Constants.pm	Exports SAFE_URL_REGEXP for shared use across templates and server validation.
Bugzilla/Bug.pm	Implements server-side validation for bug_file_loc using the shared safe-URL logic.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.