34996 - Special characters "@", "%" signs in the user name causing crash/random problems

Status: VERIFIED FIXED

(MailNews Core :: Networking, defect, P2)

Description

[cristiana]

my mail server name is mail.drumbeatdigital.com and my login name is
[e-mail].  When i try to get mail the dialog box says
retrieving mail for [e-mail], and i type my password
(which i confirmed as being correct in another mail program; kmail) another
dialog box pops up and says incorrect password, and i try the password again,
and the dialog box pops up again, ad infinitum.  Incidently this also happens
with netscape 4.72.

Comment 1

[lchiang]

If this happens with 4.x, then it may not be a Mozilla only problem.

Are you using IMAP or POP? 

Comment 2

[Richard Zach]

Are you giving the login ID as "[e-mail]" or as
"christianay"?  Can you try to see if the latter version works?

Comment 3

[lchiang]

cristiana - can you try what zach suggested?
Thanks.

Leave unconfirmed until we get more information.

Comment 4

[lchiang]

From cristiana via email:

I cant login as cristianay because my username is 
'[e-mail]' that is the problem.  (but i already
did try to 
login as cristiany and that didnt work either, i even tried to login as 
cristianay%40drumbeatdigital.com, but that didnt work either).

Comment 5

[Scott MacGregor]

Alecf, can the account manager handle '@' signs in the user name? If yes, then
bounce back to me as it must be a problem down at the protocol layer where the
'@' isn't being escaped before we try to parse the user name from the uri.

Comment 6

[selmer (gone)]

Target M17.

Comment 7

[leger]

Per Phil -- We need to set our policy on how to handle this.  There may be a 
migration issue depending on how we decided.  Also, consider the 4.x allow @ 
sign in user name pref.

Comment 8

[Alec Flett]

ok, I checked this out. Everything is happening correctly - all @'s and \'s are 
appearing correctly in the prefs, URIs are being escaped correctly, and even 
FindServer is being called with the correct username.

So I'm guessing that the protocol is trying to do it's own parsing when it 
actually goes to login.

Comment 9

[Alec Flett]

I got it!
The problem was that when we created the pop3 url, we weren't escaping the 
username, which confused the heck out of the url parser, leaving m_pop3server as 
null...
I'm testing my patch now.

Comment 10

[Alec Flett]

Attachment: fix for pop - escape the username before sending it to SetSpec

Comment 11

[Alec Flett]

I just checked IMAP, it's ok...I can't for the life of me figure out where news 
creates it's URLs :)

Comment 12

[Alec Flett]

Attachment: take two - this time handle all the pop3 servers

Comment 13

[Alec Flett]

ok, after going over nsPop3Service a bit more, I found 2 other places where 
we're poorly creating the URL.. now I'm testing this one.

Comment 14

[Alec Flett]

fix is IN.

Comment 15

[Alec Flett]

*** Bug 41661 has been marked as a duplicate of this bug. ***

Comment 16

[Karen Huang]

Copy Alec's comments from bug 41661 -- This should have fixed all 'special' 
characters, including ":", "@", "%", and I think even "\".
I'll take this one for verify.

Comment 17

[Karen Huang]

Lisa, do we have test accounts with ":", "@", "%","\" user names in house 
available for verifying this bug.
If not, cristiana, tim and gemal, do you all have test accounts available for 
external peoples to access (please send email with server name, userid & 
passwords to me if you have)...otherwise, I may need you all help for verifying 
this bug....thanks.

Comment 18

[Karen Huang]

Since we don't have such userids in house for testing..
I am just changing the summary back to "@", "%" (at least we have two peoples 
cristiana & tim can help for verifying "@" & "%" for this bugs)
I will appreciate if cristiana can help for verifying on the userid with "@" and 
tim can verify on the userid with "%". -- Thanks. 
Putting "Need help for verify" on the status whiteboard....

Comment 19

[Tim Richardson]

Build ID 2000060820 still the problem with [e-mail]

Anyone can test using that address; the crash occurs before the request for the 
POP password. 
Why is my build ID the same as last Friday? I downloaded again just now (Tuesday 
June 13 Singapore time.).

Comment 20

[Karen Huang]

Thanks for the updates.

> Anyone can test using that address
 
Can you email the password of this test account to me? ([e-mail])
Is this account created for only POP?
Maybe the build id has not been updated yet....

Comment 21

[Alec Flett]

that's tim's personal account, and as he says, you don't need the password to 
see the crash.

reopening this bug, I'll deal with it.

Comment 22

[Karen Huang]

< you don't need the password to see the crash.
Yes. I got crash too on WinNT platform.
Didn't get the talkback report but just attach the drwtsn32.log as following:

Comment 23

[Karen Huang]

I already sent email/log to Alec since there was Bugzilla error when I was 
trying to attach log here....

Comment 24

[Henrik Gemal]

Now I dont get a crash. I'm getting a dialog asking for password for:
"[e-mail]@pop3.mail.dk"
When I enter the password and press OK, I'm getting "Error in sending password 
to the server"

Comment 25

[Karen Huang]

Why I got an Alert "Please enter a valid email address" when I was tring to 
create this new profile by using "[e-mail]@pop3.mail.dk"?

Comment 26

[Henrik Gemal]

Use the following when creating the POP3 account:
Mailserver: pop3.mail.dk
Username: [e-mail]

Comment 27

[Alec Flett]

karen - the e-mail address is different from the pop3 login name.
so the e-mail address might be something like [e-mail], but the pop3 login
name might ALSO be [e-mail]. [e-mail]@bar.com is not a valid e-mail
address.

Comment 28

[Karen Huang]

Thanks. Alec. I think I know what you mean now.

Copy original comments of Phil Peterson 1999-10-13 10:05 on bug 12390:

John Friend:
> At thought just occurred to me.  Maybe this "mail.allow_at_sign_in_user_name"
> setting could be autodetected.  The really awesome way to solve this problem
> would be to just try the exact string the user enters as the user name.  If
> it works use it.  If it doesn't work (e.g. auth fails), then strip off the @
> stuff and try again.  If it works that time, make some note in prefs that
> next time you should do the stripping.  If the user ever changes their user
> name, then clear the bit that says you should do the stripping so you try the
> full name again.  The only downside I can see is that if a user enters the @
> sign, we have one failed auth try before realizing that they shouldn't have
> put the @ sign in.
>
> This would let both old users who have gotten used to our tolerance of this
> work and new users who need the @ sign in their user name without any support
> calls or custom prefs.

I saw the password dialog displayed, but because of the password, the rest of 
test....I think that Henrik already described.

Sounded like this account already created successfully but with the password 
problem, do you think this is same bug or another bug?

Comment 29

[lchiang]

Comments from Christina via email.  (Christina, you can click on the bug link 
and edit the bug yourself without having to send me email. This way, your 
response will be in the bug report in a timely manner :-)

I tried the latest build from mozillazine.org today (june 14th) and here
are the results:
pop3 on linux crashes the browser with no core or message.  
imap on linux gives this message on the console: In OnFolderLoaded for
imap://[e-mail]/INBOX 
and has no activity i nthe browser
pop3 on win32 pops up a login failed dialog box and then asks for a
password
imap on win32 does the same as pop3

Comment 30

[Alec Flett]

*** Bug 43105 has been marked as a duplicate of this bug. ***

Comment 31

[Alec Flett]

ok, I've now got a little server installed locally with accounts that contain 
extra @, %, /, and \. Hopefully that should cover it. trying each one now.

Comment 32

[Alec Flett]

ok, so problem numero uno: On usernames with percent in them, we're trying to 
unescape the username in the URL when we call GetServer(), and so "abc%efg" 
becomes "abc" - then we call the evil FindServer call with "abc" as the 
username. Doh!
I'm going to see if it's necessary to unescape the username. 

the real fix here is to simply set the incoming server in the URL in some 
out-of-band manner.

Comment 33

[Blake Ross]

*** Bug 43856 has been marked as a duplicate of this bug. ***

Comment 34

[scottputterman]

If this isn't fixed by 7/13 we are going to cut from nsbeta2.

Comment 35

[scottputterman]

marking nsbeta2- as decided by mail triage.

Comment 36

[selmer (gone)]

nsbeta3 nomination.  I'm tempted to say this is polish because I don't expect it 
to be hit a lot, but I don't know that for sure.  Assuming it's correctness, 
please update if you know otherwise.

Comment 37

[Michael Hampton]

Not hit a lot?  We've got over one million affected or potentially affected
customers here.  Fortunately Netscape 4.5 and higher have a workaround for this;
the mail.allow_at_sign_in_user_name pref.  Due to the _scale_ of the problem
here, we've had to ship an additional program which makes the necessary changes
to the prefs.js file to get this to work in 4.x.  So far we haven't had too many
people actually using the milestone builds, but a lot of them did try out
preview release 1.

Anyway, this is going to affect quite a few people, not only here (I work for an
ISP, if you couldn't tell) but elsewhere... requiring an @ or a % in the email
username is quite common for ISPs that host multiple domains.

Comment 38

[laurel]

possible item for b2 release note

Comment 39

[selmer (gone)]

Adding mail2 nomination keyword for triage effort.

Comment 40

[lchiang]

+ per mail triage

Comment 41

[Karen Huang]

*** Bug 47757 has been marked as a duplicate of this bug. ***

Comment 42

[David Hallowell]

OK, I've reproduced the crash on WinNT 4.0 (2000080420) and Linux (2000080421)
and I've got talkback ID's for each incident:
WinNT: TB15330567X
Linux: TB15329222H

These crashes occurred when clicking 'Get Msg' when trying to download POP3 mail
from an account that contains a % symbol in its username. No password dialog is
shown. Linux was using modern skin and Windows using classic skin.

Comment 43

[Alec Flett]

updating summary, adding crash keyword

Comment 44

[lchiang]

*** Bug 49207 has been marked as a duplicate of this bug. ***

Comment 45

[Vassil Peytchev]

Sorry for submitting a duplicate to this bug - I tried to search for "mail 
crash" and didn't find it. Anyway, just wanted to confirm that name%domain is a 
very common username for anyone who would use virtual domain hosting at an ISP 
(mine uses qmail as their mail server). Also, this used to work in M15, but was 
broken in M16 - I hope this might help.

Comment 46

[bs183]

it doesn't crash any more with nyghtly build 2000082020/mac, but it doesn't ask
for the password anymore, too...

Comment 47

[David Krause]

*** Bug 51364 has been marked as a duplicate of this bug. ***

Comment 48

[Jim Roskind]

PDT agreed this is a P2 level bug

Comment 49

[(not reading, please use [e-mail] instead)]

taking from alecf.

Comment 50

[(not reading, please use [e-mail] instead)]

accepting.

Comment 51

[David Krause]

*** Bug 51364 has been marked as a duplicate of this bug. ***

Comment 52

[lchiang]

*** Bug 51699 has been marked as a duplicate of this bug. ***

Comment 53

[(not reading, please use [e-mail] instead)]

adding laurel to the cc list.

Comment 54

[laurel]

I added two new users on poisonivy.mcom.com (a Netscape 3.5 server) for this
bug.

User #1:  
   Willy Wacko
   userid: ww@cko
   email address:  [e-mail]

User #2:
   P. Cent
   userid:  p%cent
   email address:  [e-mail]

Comment 55

[(not reading, please use [e-mail] instead)]

ok, I have a potential fix for this problem.

basically, here's the issue:

on the nsMsgMailNewsUrl we set the username, and later we get the username.
nsMsgMailNewsUrl inherits from nsStdUrl. in nsStdUrl.cpp, GetUsername() always
unescapes the username, where SetUsername() is just a strdup.

the key to fixing this bug is to make sure we escape the username before calling
SetUsername() on the nsMsgMailNewsUrl, and *not* to unescape after calling
GetUsername()

my fix seems to work fine for foo%bar usernames, I'm off to see how it works for
foo@bar usernames.

before I check this fix in, I'll test it heavily and get it carefully reviewed.

Comment 56

[(not reading, please use [e-mail] instead)]

fixed.

something to remember when testing on usernames with "@" (like ww@cko) is that
you set the "mail.allow_at_sign_in_user_name" pref to true in your prefs.js file.

Comment 57

[Karen Huang]

By using today's 09-14-08-M18 commercial builds
There is no crash when trying to login by using [e-mail] mail account.
I got an Alert "connection refused to the server" when login to 
tim%richardson.net mail account.
Can anybody help for verifying mail account with the "%" character?
Adding need help for verify on the status whiteboard.

Comment 58

[timeless]

Karen, please use the verifyme keyword.

Comment 59

[Karen Huang]

Thanks Laurel for the info.
By using those two users' POP accounts from poisonivy.mcom.com server
I am able to login to those two accounts from 6.0 new profiles.
I can also send and read mail messages from those two accounts.
Thanks Seth for fixing this problem and Laurel for setting users on the server.
Verified on WinNT 09-15-08-M18 commercial build
Verified on Linux 09-15-08-M18 commercial build
Verified on Mac 09-15-08-M18 commercial build
Marking as verified!!

Comment 60

[Erich 'Ricky' Iseli]

Need to have it reopened (and I haven't the "power" to do that), please someone
do this for me.

I created a test account where you can see that it isn't working with Build
2000101014 on Win98

User name: [e-mail]
POP3 server: mail.iseli.org
password: test

Comment 61

[Erich 'Ricky' Iseli]

David Krause told me on IRC that I have to add
user_pref("mail.allow_at_sign_in_user_name", true); in my prefs.js (in user
directory). A non-hacker user should not do any editing of files. This should be
set by default or even prompted when setting up the account.

Comment 62

[Erich 'Ricky' Iseli]

I confirm that this fixed the problem. For me, the bug is not fixed yet,
however. To be fixed, the above mentioned line should be automatically added in
the prefs.js.

Comment 63

[timeless]

Verah, to help people like ricky we need to relnote this.

Seth, is there any risk in changing the default to true? If there is, could you 
file a bug, pick an assignee, and explain the risk. If not, could we possibly 
change the default to true?

relnote: &branding; mailnews prefers not to accept account names containing 
&oddcharacters; if your account includes one of those characters please edit 
prefs.js (link explaining how to find and edit it) to include this string:
user_pref("mail.allow_at_sign_in_user_name", true); 

Comment 64

[Karen Huang]

I should mention that bug 53970 already logged for above problem and there was 
relnote3 on that bug keywords. Seth should look at that bug....

Comment 65

[timeless]

Thanks Karen, removing all relnote keywords; for the Release Notes please use 
bug 53970 (now marked as blocked by this fixed bug).  [reason for the 
blocking relationship] If we did not have this feature we could not possibly 
need to change the default preference.

Comment 66

[R.K.Aa.]

*** Bug 56504 has been marked as a duplicate of this bug. ***

Comment 67

[Karen Huang]

Verified again on IMAP for WinNT 10-06-09-MN6 build.
Yes!! Seth's fix on IMAP as well for @ user name account.
Adding this comments is for bug 53970 reference.

Comment 68

[Henrik Gemal]

Another bad bug related to this:
http://bugzilla.mozilla.org/show_bug.cgi?id=59231
impossible to have \ in mail passwords...:(

Comment 69

[verah (gone)]

Removing myself from list of cc's.

Comment 70

[R.K.Aa.]

*** Bug 72450 has been marked as a duplicate of this bug. ***