Contact information should use URI scheme

Created on 19 October 2021, over 3 years ago
Updated 1 June 2023, about 2 years ago

Problem/Motivation

The contact information for an email address and telephone number should use the mailto and tel schemes respectively, see RFC section 3.5.3.

Steps to reproduce

Install, edit the configuration to add Email=security@example.com and Phone=+1-201-555-0123. The resulting security.txt file shows as:

Contact: security@example.com
Contact: +1-201-555-0123

It should be:

Contact: mailto:security@example.com
Contact: tel:+1-201-555-0123

Proposed resolution

Insert the scheme in code, as per attached patch.

πŸ› Bug report
Status

Fixed

Version

1.0

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡¦πŸ‡ΊAustralia klonos 90% Melbourne, Australia - 10% Larissa, Greece

    Hey @danieljrmay πŸ‘‹ ...since it's been a year without any progress here, I hope that you won't mind if I take a crack at this.

  • Issue was unassigned.
  • Status changed to Needs review over 2 years ago
  • πŸ‡¦πŸ‡ΊAustralia klonos 90% Melbourne, Australia - 10% Larissa, Greece

    Sorry, I didn't realize that there was a patch already provided for this, since the issue was not set to NR.

    I've reviewed the patch, and the changes seem straight-forward. I'll set this up on my local and test to confirm.

  • Status changed to RTBC over 2 years ago
  • πŸ‡¦πŸ‡ΊAustralia klonos 90% Melbourne, Australia - 10% Larissa, Greece

    I ended up testing this in simplytest.me and it works:

    1. I navigated to admin /config/system/securitytxt
    2. only added dummy input for the email and phone fields
    3. saved configuration
    4. I navigated to /admin/config/development/configuration/single/export and confirmed that the settings were saved
    5. I then navigated to /.well-known/security.txt and the output as as expected:
      Contact: mailto:security@example.com
      Contact: tel:123456789
      Signature: https://master-gvsv2yytmhdtth5c31xiqvvgbpw4mmdd.tugboatqa.com/.well-known/security.txt.sig
      
  • Assigned to Kristen Pol
  • πŸ‡ΊπŸ‡ΈUnited States Kristen Pol Santa Cruz, CA, USA

    Nice fix and testing here! I'll get this into the upcoming release with the D10 update.

  • Issue was unassigned.
  • Status changed to Fixed about 2 years ago
  • πŸ‡ΊπŸ‡ΈUnited States Kristen Pol Santa Cruz, CA, USA

    This has been merged and will be in the next release :)

  • πŸ‡ΊπŸ‡ΈUnited States Kristen Pol Santa Cruz, CA, USA

    A new 8.x-1.3 release has been created that includes this fix:

    https://www.drupal.org/project/securitytxt/releases/8.x-1.3 β†’

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024