137153 - POST requests sent without message body

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Jeffrey Baker]

(this may be net:http or html forms, i picked the former)

Mozilla 0.9.9 on Linux can sometimes send bogus HTTP POST requests.  A form with
no named inputs will cause a POST request to be sent with no content length and
no message body.

<form method="post"><input type="submit"></form>

will cause this HTTP request to be sent:

POST /something.html HTTP/1.1
Host: jwb.gghcwest.com
User-Agent: Mozilla/5.0 Galeon/1.2.0 (X11; Linux i686; U;) Gecko/20020402
Accept:
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,video/x-mng,image/png,image/jpeg,image/gif;q=0.2,text/css,*/*;q=0.1
Accept-Language: en-us, en;q=0.50
Accept-Encoding: gzip, deflate, compress;q=0.9
Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q=0.66
Keep-Alive: 300
Connection: keep-alive
Referer: http://jwb.gghcwest.com/something.html
Content-Type: application/x-www-form-urlencoded

That's it: no message body and no content length header.  This seems to violate
RFC 2616 section 4.4 "If a request contains a message-body and Content-Length is
not given, the server SHOULD respond with 400 (bad request)..."  Indeed this
what the server responds with.

I discovered this problem because a site had a "License Agreement" form with
only an unnamed submit button:
http://www.ahpah.com/cgi-bin/suid/~pah/demo_license.cgi

Comment 1

[Jeffrey Baker]

Attachment: testcase

Comment 2

[Darin Fisher]

-> jkeiser (necko just posts whatever data form submission gives it)

Comment 3

[Jeffrey Baker]

I agree that an empty POST request is stoopid, but adding Content-Length: 0
would at least bring the HTTP side into RFC goodness.

Comment 4

[John Keiser (jkeiser)]

Strange, I would have thought this fixed by bug 129333.

Comment 5

[Jeffrey Baker]

Ah, it probably was checked in on the trunk and not the 0.9.9 branch.  I am
unable to test nightlies, but if someone else gives the testcase a spin they
could verify.

Comment 6

[Randell Jesup [:jesup] (needinfo me)]

WFM with current trunk as per jkeiser and jeff baker's comments; probably was
never checked into 0.9.9 branch.