Absolute URLs are reformatted to relative paths (e.g., ../../)

[Veudzveulay]

Hello,

I'm experiencing a critical issue with Pretty Block when working with absolute URLs in blocks. Specifically:

When I input an absolute URL (e.g., https://example.com/resource), it is automatically reformatted to a relative path like ../../resource.
Due to this, my hosting provider blocks the save operation, as it does not accept such relative paths for security or configuration reasons.
This makes it impossible for me to save the block and prevents me from using Pretty Block effectively.

Please let me know if more information or logs are needed to investigate further.

Thank you!

[BarbUk]

Hi,

Due to this, my hosting provider blocks the save operation, as it does not accept such relative paths for security or configuration reasons.

All hosting using a WAF should be blocking this by default.
It's detected as a Path Traversal Attack (/../).

[BarbUk]

More information about the request impacted:

POST /module/prettyblocks/ajax HTTP/1.1

Pattern match "(?:^|[\\/])\\.\\.(?:[\\/]|$)" at ARGS:state. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:state

The json posted:

{
    "id_prettyblocks": 1,
    "action": "updateBlockConfig",
    "state": {
        "content": {
            "type": "editor",
            "label": "Description",
            "force_default_value": true,
            "value": "<h2 data-placeholder-blurred=\"R&eacute;digez un contenu\" data-placeholder-focused=\"Heading 2\"><a title=\"marques\" href=\"../../../../url_marque.html\" target=\"_blank\" rel=\"noopener\">marques</a><a title=\"fabriqu&eacute;s en France\" href=\"../../../../category/product.html\" target=\"_blank\" rel=\"noopener\">fabriqu&eacute;s en France</a>&nbsp;ainsi que de la&nbsp;<a title=\"robinetterie &agrave; &eacute;conomie d'eau\" href=\"../../../../categorie.html\" target=\"_blank\" rel=\"noopener\">robinetterie &agrave; &eacute;conomie d'eau</a>"
        },
        "text_align": {
            "type": "select",
            "label": "text alignment",
            "default": "left",
            "choices": {
                "left": "Left",
                "center": "Center",
                "right": "Right"
            },
            "force_default_value": true,
            "value": "left"
        },
        "templates": {
            "default": "module:crea_prettyblocks/views/templates/blocks/html.tpl"
        },
        "templateSelected": "default",
        "default": {
            "container": true,
            "load_ajax": false,
            "bg_color": ""
        }
    },
    "ajax": true,
    "ctx_id_lang": 1,
    "ctx_id_shop": 1,
    "ajax_token": "xxx"
}