723805 - XMLHttpRequest sends "OST", instead of "POST", when send() is a File.

Status: RESOLVED INCOMPLETE

(Core :: DOM: Core & HTML, defect)

Description

[Timothy Wilson]

Summary: When a XmlHttpRequest is open()'ed using the method POST, and the xhr.send() method is sending a DOM "File" object, the server receives "OST" as a method, causing a Status 501.

Steps to reproduce:
1. visit my website (www.wipnation.com) and sign up(or log in if already signed up)
2. back on the main page (/ or /index.jsp), click on +Post Art, which is near the top middle of the webpage
3. on the resulting page, press 'Browse..."
4. pick a JPEG or PNG file from your disk.
5. press "Open"

Results: my Tomcat 6 server reports Status 501 error code (visible in logs/firebug output)

I'll try to make a file upload test page that won't require a login within 48 hours.

Log attached, see lines 73812(POST)  and 74042 (Status 501)

Does not happen on other browsers, or FF9. 
Cannot confirm other OSes.
My site has not had code changed on it for about 3 weeks. This bit of code  has been working since FF 3.6/4 (July 2011)

Comment 1

[Timothy Wilson]

Apparently, attachments won't work in ff10 on bugzilla. :/ Trying chrome.

Comment 2

[Timothy Wilson]

Attachment: FF10 network log, see bug body for line numbers related to problem.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Hmm.  This is an https URI, right?  This may be an instance of bug 702111.  Can you check whether setting NSS_SSL_CBC_RANDOM_IV=0 in your environment fixes the problem for you?

Comment 4

[Boris Zbarsky [:bzbarsky]]

Though if that were the case then recent enough Chrome builds would have the same problem...

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

I verified it is caused by the 1/(n-1) record splitting.

I remember that Adam Langley said that Chrome would soon switch to doing record splitting more like Firefox, but the problem doesn't occur in Chrome release or Chrome Canary.

Comment 6

[Adam Langley]

So we certainly do record splitting since Chrome 16, but there are some differences with POSTS.

In 16 we'll send a split record (so, 2 records) for the headers and another packet with a split record for the body.

In 17+ we'll merge the body into the headers if the sum is < 1400 bytes and so there'll be only a single packet with two records. I believe that's Firefox's behaviour today.

Comment 7

[Adam Langley]

(And, to be clear, the splits are 1 byte and the rest of the bytes, same as FF10.)