|
1 | 1 | <!-- |
2 | | - Nonfunctional subdomains: |
| 2 | + Nonfunctional hosts in *youku.com: |
3 | 3 |
|
4 | 4 | - (www.)? ¹ |
5 | 5 | - static.atm ¹ |
|
34 | 34 | - travel |
35 | 35 | - tv ¹ |
36 | 36 | - v ¹ |
| 37 | + - vip ¹ |
37 | 38 | - yj ¹ |
38 | 39 | - bbs.yj ¹ |
39 | 40 | - yuanxian ¹ |
|
44 | 45 | ³ Plaintext reply |
45 | 46 |
|
46 | 47 |
|
47 | | - Fully covered subdomains: |
| 48 | + Problematic hosts in *youku.com: |
48 | 49 |
|
49 | | - - login |
50 | | - - vip |
| 50 | + - login * |
| 51 | + - passport ˣ |
51 | 52 |
|
| 53 | + * Protocol-relative inclusions of static.ykimg.com |
| 54 | + ˣ Mixed css |
52 | 55 |
|
53 | | - Mixed content: |
54 | 56 |
|
55 | | - - css on vip from static.youku.com * |
| 57 | + Insecure cookies are set for these domains: |
| 58 | +
|
| 59 | + - .youku.com |
| 60 | +
|
56 | 61 |
|
57 | | - - Images, on: |
| 62 | + Mixed content: |
| 63 | +
|
| 64 | + - css on passport from static.youku.com ʳ |
58 | 65 |
|
59 | | - - vip from r[1-4].ykimg.com * |
60 | | - - vip from static.atm.youku.com * |
61 | | - - vip from static.youku.com * |
| 66 | + ʳ Unsecurable <= refused |
62 | 67 |
|
63 | | - * Unsecurable <= refused - |
64 | | - - |
65 | 68 | --> |
66 | 69 | <ruleset name="Youku.com (partial)" platform="mixedcontent"> |
67 | 70 |
|
| 71 | + <!-- Direct rewrites: |
| 72 | + --> |
68 | 73 | <target host="login.youku.com" /> |
69 | | - <target host="vip.youku.com" /> |
| 74 | + <target host="passport.youku.com" /> |
| 75 | + |
| 76 | + <!-- Complications: |
| 77 | + --> |
| 78 | + <target host="static.ykimg.com" /> |
| 79 | + |
| 80 | + <exclusion pattern="^http://static\.ykimg\.com/" /> |
| 81 | + |
| 82 | + <!-- +ve: |
| 83 | + --> |
| 84 | + <test url="http://static.ykimg.com/yk/lib/css/youku.17b39556b5.css" /> |
| 85 | + |
| 86 | + |
| 87 | + <!-- Not secured by server: |
| 88 | + --> |
| 89 | + <!--securecookie name="^\.youku\.com$" host="^ykss$" /--> |
| 90 | + |
| 91 | + |
| 92 | + <!-- Protocol-relative includes on login: |
| 93 | + --> |
| 94 | + <rule from="^https://static\.ykimg\.com/" |
| 95 | + to="http://static.ykimg.com/" downgrade="1" /> |
70 | 96 |
|
| 97 | + <test url="https://static.ykimg.com/yk/passport/css/login_page.ee46495e24.css" /> |
71 | 98 |
|
72 | 99 | <rule from="^http:" |
73 | 100 | to="https:" /> |
|
0 commit comments