1395002 - "Save Image As..." incorrect use of GET instead of POST method

Status: NEW

(Firefox :: General, defect, P3)

Description

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16275

Steps to reproduce:

1. Go http://waifu2x.udp.jp/
2. Select any image file and pass reCAPTCHA
3. Press Convert
4. "Save Image As..." for the presented image


Actual results:

The saved file format is incorrect with the 18-byte size


Expected results:

The presented image should be correctly saved

Comment 1

[YF (Yang)]

"Save Image As...":
GET  http://waifu2x.udp.jp/api [HTTP/1.1 405 Method Not Allowed 307ms]
"Save Page As..." (Ctrl+S) on the image opened:
POST http://waifu2x.udp.jp/api [HTTP/1.1 200 OK 0ms]

Comment 2

[Jim Mathies [:jimm]]

Hey Jason, can you help file this? Sounds like networking or something related.

Comment 3

[Jason Duell]

Sorry to barf this back up to general Firefox triage, but I doubt this is a networking bug.  It's almost definitely some code (the "save image as" code) that's calling into necko and mistakenly asking to use a GET instead of a POST.

Presumably the correct thing to do here is to actually use the same method (GET or POST, etc) as was used to fetch the image originally.  That will probably require hanging on to the original channel, or keeping track of the method some other way, then setting the new channel's nsIHttpChannel.requestMethod field to 'POST' or whatever (no need to set for GET: that's the default).  In the case of a POST you'll also need to make sure that whatever data was posted (i.e. call the nsIUploadChannel2.explicitSetUploadStream() method with the same stream, rewound if needed to the start of the stream).

Comment 4

[Panos Astithas (he/him) [:past] (please ni?)]

I will try to find someone to work on this.

Comment 6

[Radist]

We have the same problem on our internal website.
It has a form like

<form target="https://domain/path/to/download" method="post" target="_blank">
<input type="hidden" name="secret" value="***" />
<input type="hidden" name="id" value="123" />
<input type="submit" />
</form>

Page https://domain/path/to/download returns Content-Disposition: inline, filename="123.jpg" header. But it returns error message instead of file for missing id or secret parameter.
When user press Ctrl+S, it works correctly. But "Save image as..." leads to sending GET request without parameters. Also, "Send image by email..." leads to opening the outlook with https://domain/path/to/download link. Seems like this menu items are broken for images loaded via POST requests.

The fundamental problem here is that POST requests are not idempotent, so it's incorrect to send repeated request. The only valid way to save image loaded by POST is getting it from cache (like Save as... works)..