• # regex

    Posté par . En réponse au journal HTTPS Everywhere. Évalué à 5.

    Le véritable avantage de cette extension sur d'autres proposant des fonctionnalités équivalentes (ForceTLS ou le trop bedonnant NoScript), c'est de ne pas se limiter à transformer http et https dans les urls concernées. L'exemple des sites liés à wikimedia est très informatif à ce sujet:

    #cat Wikipedia.xml
    <!-- www.wikisomething.org is generally a valid
    domain containing general information on a project and is
    simply not available at all in HTTPS. Everything with a /wiki
    suffix, however, is a language-specific page that is available in
    HTTPS. Hence these rules avoid redirecting www.wikisomething.org,
    while redirecting all language-specific subdomains. If you
    navigate first to the WWW page, you could be vulnerable to SSL
    stripping, but if you succeed in submitting a query from there
    in a specific language without interference, you'll subsequently
    be protected. -->

    <ruleset name="Wikipedia">
    <exclusion pattern="^http://www\.wik(ipedia|inews|isource|ibooks|iquote|iversity)\.org/"/>
    <rule from="^http://([^@:/]+)\.wik(ipedia|inews|isource|ibooks|iquote|iversity|tionary)\.org/wiki/"
    to="https://secure.wikimedia.org/wik2ドル/1ドル/wiki/"/>
    <rule from="^http://([^@:/]+)\.wik(ipedia|inews|isource|ibooks|iquote|iversity|tionary)\.org/?$"
    to="https://secure.wikimedia.org/wik2ドル/1ドル/wiki/"/>
    <rule from="^http://(meta|commons|incubator|species|outreach|strategy|usability|wikimania|test|survey)\.wikimedia\.org/wiki/"
    to="https://secure.wikimedia.org/wikipedia/1ドル/wiki/"/>
    </ruleset>