[Feature Request] Allow URL Regular Expressions to Match Query String

[kapinga]

I am a long-time user of BrowseRouter (and before it, BrowserSelector) to route links to my work domains into Edge and ~everything else into FireFox. Thank you for your work maintaining and expanding this application!

My employer uses email link checking and, importantly, I do not want to disable these checks (as is offered by the "filter" capability). Previously, we've used ProofPoint, which embeds the destination URL as part of the URI's Path (e.g. "https://urldefense.com/v3/__https://www.microsoft.com") . I was able to write a series of URL regexes to evaluate the destination path and select the right browser.

My employer has recently switched to using Outlook safelinks, which embeds the destination URL as a query term. After some testing, I determined that any regex url which references any part of the URI's query (e.g. "/.*\\.safelinks\\.protection\\.outlook\\.com/[^?]*\\?url=/") will never match. This is implemented in UrlPreferenceExtensions.GetDomainAndPattern, which explicitly only includes the URI's Authority and AbsolutePath. To your credit, the README documents that regex URLs use the domain and path, although it does not make clear that the query is not considered.

UrlPreferenceExtensions also defines an undocumented format offset by ? characters that does include the query but only permits simple wildcards (each * is expanded to .* while all other regex special characters are escaped). This works for simple domain checks, but does not work reliably on anything more advanced (i.e., there's no way to do a wildcard match on "*.contoso.com" without also potentially matching "www.evilsite.com/contoso.com"). Obviously, choosing the wrong browser is not a safety consideration, but it is an annoyance.

I'm requesting some way to enable arbitrary regular expressions to be evaluated against URLs that include the query (and probably the fragment too). I envision this either as a global option (e.g. "includeQueryInRegex") that defaults to false and applies to all URL regexes, or provide yet another syntax (perhaps using |) to define those matches on a case-by-case basis. I'm happy to contribute ideas on the design if you're interested in it, but do not have a C# toolchain set up to do much development myself.

(Tagging @nref for visibility, as noted in CONTRIBUTING.md).

[nref]

Hi @kapinga , and thanks for using BrowseRouter! Helping people is the best part of maintaining it.

I am happy to look into adding regex support for the whole URL. I haven't thought deeply about it, so there may be snags, but I'm all for trying.

I'm very happy to receive further design ideas / input from you and any real human!

[kapinga]

Thanks @nref

As I was writing the issue request, I concluded that the existing ? functionality was good enough for getting functionality that works for 99% of the links I actually receive, so I'll concede this is probably a low-priority request. That said, there's an obvious asymmetry: URL paths can be matched against arbitrary regexes, while URL queries only support the simpler glob wildcards, which are more likely to make unexpected matches.

If you were to add it, I'd propose the ? and / features be effectively combining: Keys wrapped by ?/ and /? would evaluate the regex, without escaping, against the URL including the query. Example code would be to add the following at line 30 of UrlPreferenceExtensions.cs:

    if (urlPattern.StartsWith('?/') && urlPattern.EndsWith('/?'))
    {
      // The domain from config is a regex
      string domain = uri.Authority + uri.PathAndQuery;
      string pattern = urlPattern.Substring(2, urlPattern.Length - 4);

      return (domain, pattern);
    }

This should be safe, because uri.Authority cannot start with a \ and, so, any existing query starting with ?\ would never match. The reversed structure, \?<regex>?\ is also safe (because a valid regex cannot start with ? as far as I know), but, well, regular expressions can be really complicated and, IMO, it'd be easier to confuse the leading ? as being part of the regex.