{"id":21277962,"url":"https://github.com/b13/trusted-url-params","last_synced_at":"2025-09-15T09:04:14.370Z","repository":{"id":46344633,"uuid":"399961759","full_name":"b13/trusted-url-params","owner":"b13","description":"TYPO3 Extension to ensure that only safe queryParams from TYPO3s Routing are added to generated links","archived":false,"fork":false,"pushed_at":"2023-04-17T09:55:26.000Z","size":25,"stargazers_count":8,"open_issues_count":2,"forks_count":1,"subscribers_count":8,"default_branch":"main","last_synced_at":"2024-10-20T23:13:48.398Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/b13.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-08-25T21:30:11.000Z","updated_at":"2023-11-15T08:32:55.000Z","dependencies_parsed_at":"2022-09-05T14:30:50.901Z","dependency_job_id":null,"html_url":"https://github.com/b13/trusted-url-params","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/b13%2Ftrusted-url-params","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/b13%2Ftrusted-url-params/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/b13%2Ftrusted-url-params/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/b13%2Ftrusted-url-params/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/b13","download_url":"https://codeload.github.com/b13/trusted-url-params/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225708281,"owners_count":17511635,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-21T10:08:26.849Z","updated_at":"2024-11-21T10:08:27.386Z","avatar_url":"https://github.com/b13.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Trusted URL Params - A TYPO3 extension to generate safe URLs\n\nThis TYPO3 extension modifies the generation of links to TYPO3 pages to only include the current query\nparameters (`$_GET`) that have been resolved by TYPO3's Routing.\n\n## Background\n\nTYPO3's `typolink` functionality is super-powerful but also drags a lot of history with it. Various issues\nhave been addressed with TYPO3's Routing, which was introduced in TYPO3 v9.\n\nHowever, one main issue still resolves: The usage of the option `addQueryString` of `typolink`.\nIf used, the option adds *any* existing `$_GET` parameter to the generated URL and - in the worst case -\ngenerates a valid cHash for this link.\n\n`addQueryString` allows to define an exclude list of GET parameters, however this issue\ncan never be solved properly with an exclude list, but rather an allow-list. With TYPO3 v9,\nwe already have an \"allow list\" of the current request - all GET parameters or arguments that\nhave been found in the route path (\"route arguments\"). This is a much better way to generate\nthe \"addQueryString\" logic than using the plain `$_GET` array.\n\nSince TYPO3 v9, this issue has become more visible as the commonly used `seo` extension\nuses `addQueryString` to generate the canonical tag, or the language menu.\n\n## How we fixed it\n\nThis extension provides an XCLASS (as there is currently no alternative to hook into this place of link generation)\nand only takes safe query parameters from the current URL, and only for generated URLs that use the `addQueryString`\nflag.\n\n## When to use this extension\n\nWe recommend using this extension\n* if you have trouble with SEO campaigns and an invalid canonical tag\n* or if (valid) bots taking crazy links and fill your cache backends or eat up your server resources\n* and if you know you don't misuse \"addQueryString\" in any other places such as your own TypoScript or third-party extensions\n\nPlease read https://typo3.org/security/advisory/typo3-psa-2021-003 for more details.\n\n## TYPO3 v12\nTYPO3 v12 finally enforces addQueryString to only allow \"trusted\" URL Parameters\nmaking this extension obsolete, however the extension continues to be compatible\nwith TYPO3 v12 when extension use legacy functionality.\n\nSee https://review.typo3.org/c/Packages/TYPO3.CMS/+/75864 for the related\ncore change.\n\n## Installation\n\nInstall this extension via `composer req b13/trusted-url-params` or download it from the [TYPO3 Extension Repository](https://extensions.typo3.org/extension/trusted_url_params/) and activate\nthe extension in the Extension Manager of your TYPO3 installation.\n\nNote: This extension is compatible with TYPO3 v9, v10 and v11.\n\n## Configuration\n\nThis extension provides safe URLs by default, and no further configuration is needed. However, custom TypoLink\nlinks can use the `addQueryString.includeUntrusted = 1` property to also include URL parameters that are\nadded as GET parameters (such as query strings from SolR).\n\n### Possible side effects\n\nAs we believe in the concept of an \"allow list\", we further want to extend this configuration to\nallow regular query parameters if configured in e.g. a site configuration to allow proper\npagination links, which might be an issue.\n\n## Inspiration\n\n* TYPO3 Core v9 Routing (Thanks to Oliver Hader and Benni Mack)\n* Helmut Hummel (original idea on how to solve it \"the core way\")\n* Extension [\"urlguard\"](https://github.com/sourcebroker/urlguard) (Thanks to Krystian Szymukowicz from SourceBroker)\n* Extension [\"urlguard2\"](https://github.com/studiomitte/urlguard2) (Thanks to Georg Ringer from Studio Mitte)\n* Extension [\"seo-canonical-guard\"](https://github.com/wazum/seo-canonical-guard)\n\n## Credits\n\nThis extension was created by Benni Mack in 2021 for [b13 GmbH, Stuttgart](https://b13.com).\n\n[Find more TYPO3 extensions we have developed](https://b13.com/useful-typo3-extensions-from-b13-to-you) that help us deliver value in client projects. As part of the way we work, we focus on testing and best practices to ensure long-term performance, reliability, and results in all our code.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fb13%2Ftrusted-url-params","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fb13%2Ftrusted-url-params","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fb13%2Ftrusted-url-params/lists"}