Skip to content

fix(favicon): don't treat rel=alternate links as favicon candidates - #2680

Merged
Mzack9999 merged 1 commit into
projectdiscovery:devfrom
Yeagerist0:fix/favicon-ignore-rel-alternate
Oct 23, 2026
Merged

Mzack9999 merged 1 commit into
projectdiscovery:devfrom
Yeagerist0:fix/favicon-ignore-rel-alternate

Conversation

@Yeagerist0

@Yeagerist0 Yeagerist0 commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #2683

What

extractPotentialFavIconsURLs treats any <link rel="alternate"> as a favicon candidate. That rel marks RSS/Atom feeds and hreflang translations, not icons. This PR drops alternate from the token list. rel="alternate icon" still matches through its icon token.

Why it matters

Each alternate link is fetched as a possible favicon. After two network failures HandleFaviconHash stops looking, so a page whose hreflang links point to unreachable hosts never gets its real icon hashed. Repro page served on 127.0.0.1:18432:

<link rel="alternate" hreflang="de" href="http://127.0.0.1:1/de/">
<link rel="alternate" hreflang="fr" href="http://127.0.0.1:1/fr/">
<link rel="icon" href="http://localhost:18432/icon.png">
$ httpx -u http://127.0.0.1:18432/ -favicon -silent -timeout 3 -retries 0
dev:   http://127.0.0.1:18432/ []
patch: http://127.0.0.1:18432/ [1799757125]

On dev, the server log shows only /, /http://127.0.0.1:1/de/ and /http://127.0.0.1:1/fr/; /icon.png is never requested. Even when the icon is eventually found, every feed or translation link costs one extra request per target.

Test

TestExtractPotentialFavIconsURLs_IgnoresAlternateLinks fails on dev (returns /feed.xml and the hreflang URL as candidates) and passes with the fix. go test ./runner/ passes.

AI disclosure

I used Claude Code to help read the code and draft the test. I reproduced the bug against a local server and checked the before/after output above myself.

Summary by CodeRabbit

  • Bug Fixes
    • Updated favicon detection to ignore links marked only as alternate, while continuing to recognize links with icon-related markers.

rel="alternate" marks RSS/Atom feeds and hreflang translations. Each
one was fetched as a possible favicon, and two failed fetches end the
search, so pages with two unreachable alternates never got their real
icon hashed. "alternate icon" still matches through its "icon" token.
@coderabbitai

coderabbitai Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: e396dd6e-7df3-4e99-9add-0955fa60710f
📥 Commits

Reviewing files that changed from the base of the PR and between bf028a2 and 41840a5.

📒 Files selected for processing: 2
  • runner/runner.go
  • runner/runner_test.go

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The favicon candidate filter no longer accepts alternate alone as an icon relation. The test checks that alternate and stylesheet links are excluded, while shortcut-icon and icon links remain candidates.

Changes

Favicon relation filtering

Layer / File(s) Summary
Filter favicon relations
runner/runner.go, runner/runner_test.go
The filter no longer accepts alternate alone. The test checks that alternate and stylesheet links are excluded while shortcut-icon and icon links remain candidates.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Suggested reviewers: mzack9999

Merge Risk: ⚪ Minimal · up to 41840

No actionable merge-blocking risk is evident in the reviewed change.

Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks: 4 passed
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the main change: excluding rel=alternate links from favicon candidates.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

A rabbit checks each link with care,
“Alternate alone” is not an icon there.
Shortcut and icon pass the test,
While stylesheet links go take a rest.
The favicon list is neat and small,
This bunny approves them all!

Comment @coderabbitai help to get the list of available commands.

@Mzack9999 Mzack9999 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The extra fetches are real. rel=alternate is a feed or a translation, and two of those failures stop HandleFaviconHash before the real icon. The new test fails on dev by also returning /feed.xml and the hreflang URL, and it passes once alternate is dropped. rel="alternate icon" still matches through the icon token. Linked #2683.

CI had not run because the workflows were waiting on a first-time contributor approval.

@Mzack9999
Mzack9999 merged commit 34719db into projectdiscovery:dev Oct 23, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Favicon extraction treats rel=alternate links as icons

2 participants