fix(facebook/search): preserve query identity + drop redirect shims (#2090) - #2194
Merged
jackwener merged 2 commits intoJul 29, 2026
Merged
Conversation
…ackwener#2090) The jackwener#2126 extractor deduped and reported result URLs as `origin + pathname`, dropping the query string. But `permalink.php?story_fbid=…`, `story.php?…` and `watch/?v=…` carry their identity in the query — so two *different* posts or videos collapsed into a single row and only the first survived dedup. Add `entityKey(u)` that keeps only the identity params (story_fbid, fbid, id, v, story_id) and strips FB's per-render tracking nonces (__cft__, __tn__, ref). Distinct posts now stay distinct, while the same post rendered twice with different nonces still dedupes to one row. Vanity paths without identity params keep collapsing to the bare pathname (unchanged). Also reject `l.` / `lm.` `facebook.com` hosts: their `/l.php?u=…` outbound-link wrappers passed the host regex and the vanity path catch-all, leaking external redirect shims into the results. Adds offline regression tests for distinct permalink/watch identities, nonce dedup, and the redirect-shim guard.
jackwener
force-pushed
the
fix/facebook-search-query-identity
branch
from
July 29, 2026 11:46
842e3ce to
e22cef0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the merged #2126 facebook-search rewrite. Two residual defects, both confirmed by offline JSDOM reproduction against the current code:
1. Query-identity collision (correctness bug)
The extractor deduped and reported result URLs as
origin + pathname, dropping the query string. For query-identity destinations —permalink.php?story_fbid=…,story.php?…,watch/?v=…— the query is the identity, so two different posts/videos collapse into one row and only the first survives dedup:Fix:
entityKey(u)keeps only the identity params (story_fbid, fbid, id, v, story_id) and strips FB's per-render tracking nonces (__cft__,__tn__,ref). Distinct posts stay distinct; the same post rendered twice with different nonces still dedupes to one row. Vanity paths without identity params keep collapsing to the bare pathname (existing dedup test unchanged).2. Outbound-redirect shim leak
l.facebook.com/lm.facebook.com/l.php?u=…wrappers passed the host regex(^|\.)facebook\.com$and the vanity path catch-all, so external-link redirects showed up as "search results." Added a host guard rejecting thel./lm.shims (m.facebook.comis intentionally not matched).Tests
buildSearchExtractScriptis exercised via JSDOM (same harness as the existing tests). Added regression tests for distinct permalink/watch identities, nonce dedup, and the redirect-shim guard.This supersedes my earlier #2132 (which predated #2126 and overlapped its role=feed rewrite) — closing that in favor of this focused delta.