Hardening: unhooked emitters show the primary host on alias/onion pages #15

New issue

Closed

opened 2026-10-15 22:38:58 -07:00 by eric · 0 comments

eric commented

2026-10-15 22:38:58 -07:00

Owner

Type: hardening / onion privacy hygiene. Found by security audit run 3 (commit 01195c8) in a single-site lab sweep of core URL emitters.

What happens

On pages served on a non-primary host (for example the onion), these core emitters still output the primary clearnet host because the plugin does not filter them:

REST index url field (raw siteurl option);
get_header_image() / get_background_image() (absolute theme_mod URLs);
HreflangEmitter always emits an x-default link to the primary host (src/Seo/HreflangEmitter.php:72-78), even when no host has a locale.

(Feed/REST guid is tracked separately in #10.) Correctly rewritten already: Link headers, import map / script modules, srcset, site icon, custom logo, oEmbed and RSD links.

Why it is only hardening

Only the primary host is disclosed, never a client-chosen host, and hreflang already publishes configured hosts by design.

Suggested fix

Route rest_index (url), theme_mod_header_image and theme_mod_background_image through UrlRewriter. Consider emitting x-default only when at least one host has a locale, and document that hreflang publishes the primary host on every alias.

**Type:** hardening / onion privacy hygiene. Found by security audit run 3 (commit `01195c8`) in a single-site lab sweep of core URL emitters. ## What happens On pages served on a non-primary host (for example the onion), these core emitters still output the primary clearnet host because the plugin does not filter them: - REST index `url` field (raw `siteurl` option); - `get_header_image()` / `get_background_image()` (absolute theme_mod URLs); - `HreflangEmitter` always emits an `x-default` link to the primary host (`src/Seo/HreflangEmitter.php:72-78`), even when no host has a locale. (Feed/REST `guid` is tracked separately in #10.) Correctly rewritten already: Link headers, import map / script modules, srcset, site icon, custom logo, oEmbed and RSD links. ## Why it is only hardening Only the primary host is disclosed, never a client-chosen host, and hreflang already publishes configured hosts by design. ## Suggested fix Route `rest_index` (url), `theme_mod_header_image` and `theme_mod_background_image` through `UrlRewriter`. Consider emitting `x-default` only when at least one host has a locale, and document that hreflang publishes the primary host on every alias.

eric added the

enhancement

security

labels

2026-10-15 22:38:58 -07:00

eric referenced this issue from a commit

2026-10-16 13:04:29 -07:00

fix: stop unhooked emitters naming the primary host on aliases

eric closed this issue

2026-10-16 13:04:29 -07:00