Restrict the instagram and vk.com redirections to web destinations

Prerequisites

• This rule only prevents tracking.
• This rule does not destroy the function of the page.

Description

Two existing redirections are broader than the wrappers they target. This is a bug fix for both; no other field changes.

instagram: the redirection is .*u=([^&]*). It has no anchor, so it applies to any instagram.com url that contains u= somewhere, including inside another parameter name such as menu=. It also accepts any scheme.

• https://www.instagram.com/accounts/login/?next=%2Fp%2Fabc%2F&u=12 becomes 12, so the login link is lost.
• https://l.instagram.com/?u=javascript%3Aalert(1)&e=x becomes javascript:alert(1).

vk.com: to=([^&]*) accepts any scheme, so https://vk.com/away.php?to=javascript%3Aalert(1) becomes javascript:alert(1).

The new patterns only match the link shims themselves (l.instagram.com/?u=, lm.instagram.com/?u=, vk.com/away.php?to=). The destination must start with http:// or https://, plain or URL-encoded. Valid links keep working exactly as before. The urlPattern of both providers stays as it is.

Affected fields

1. redirections of the provider instagram
2. redirections of the provider vk.com

Change in data.min.json

"instagram": {
    "redirections": [
        "^https?:\\/\\/l[a-z]?\\.instagram\\.com\\/\\?(?:u=|[^#]*?&u=)(https?(?::|%3[Aa])(?:\\/|%2[Ff]){2}[^&#]+)"
    ]
},
"vk.com": {
    "redirections": [
        "^https?:\\/\\/vk\\.com\\/away\\.php\\?(?:to=|[^#]*?&to=)(https?(?::|%3[Aa])(?:\\/|%2[Ff]){2}[^&#]+)"
    ]
}

Example URLs

URL	Before	After
https://l.instagram.com/?u=https%3A%2F%2Fexample.com%2Fshop%3Fid%3D1&e=AT0abcDEF	https://example.com/shop?id=1	same
https://lm.instagram.com/?u=https%3A%2F%2Fexample.com%2F&e=AT1x	https://example.com/	same
https://www.instagram.com/accounts/login/?next=%2Fp%2Fabc%2F&u=12	12	unchanged
https://l.instagram.com/?u=javascript%3Aalert(1)&e=x	javascript:alert(1)	unchanged
https://l.instagram.com.evil.example/?u=https%3A%2F%2Fexample.com%2F&e=x	https://example.com/	unchanged, not an instagram host
https://vk.com/away.php?to=https%3A%2F%2Fexample.com%2Fseite%3Fa%3D1&cc_key=	https://example.com/seite?a=1	same
https://vk.com/away.php?to=javascript%3Aalert(1)	javascript:alert(1)	unchanged

Note

59 of the 64 redirections in the current catalog do not limit the captured destination to http(s) either. Most of them are anchored to one wrapper path, so the risk is low, but the same (https?(?::|%3[Aa])(?:\/|%2[Ff]){2}[^&#]+) capture could be used there in later, separate merge requests.

Testing

Tested offline in URL Check 3.5 (Android 15 emulator), which applies this catalog with Java regexes: "Before" is the current catalog, "After" the catalog with this change; all 9 instagram and vk cases above as expected, 50 of 50 together with the two companion changes (globalRules, LinkedIn). The patterns give the same results in JavaScriptCore, with and without the i flag. Inputs up to 160 KB (long hosts, many parameters, long tokens) took at most 10 ms per pattern in Java and 8 ms in JavaScriptCore, with no stack overflow at a 512 KB thread stack.

Companion MRs: !88 (LinkedIn redirections), !90 (globalRules). The three change different fields and merge without conflict in any order.

AI-Assisted-By: Claude Opus 5.5 (xhigh)