1495313 - Failures in xhr/send-authentication-competing-names-passwords.htm

Status: RESOLVED FIXED

(Core :: Networking, enhancement, P3)

Description

[Thomas Wisniewski [:twisniewski]]

NS_NewURI does not consider a URL with an empty username (just a password) to be valid. For instance: http://:[e-mail]

This causes us to fail two of the WPTs in xhr/send-authentication-competing-names-passwords.htm.

Blink and WebKit pass these tests, while Edge doesn't seem to support username *or* password in URLs passed to xhr.open. Per the WhatWG URL and XHR specs, we seem to be doing the wrong thing here.

anne, smaug, what do you think? It seems like we would probably need to address this in NS_NewURI, not the XHR code. Should we?

Comment 1

[Anne (:annevk)]

Yeah, this should be fixed in the URL parser. No bug blocking bug 906714 is about this as far as I can tell. Valentin, do you know of any, do you want to reuse this bug, or should a new bug be filed?

Comment 2

[Valentin Gosu [:valentin] (he/him)]

There might be one, but I can't find it right now. I'll just use this one for the fix.

Comment 3

[Valentin Gosu [:valentin] (he/him)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=9d28e96fc386e29007259cd140ee3fdc11a37ba2

Comment 4

[Valentin Gosu [:valentin] (he/him)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f5f536464baf19d7300df72431998ad00d7f2327

Comment 5

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1495313 - Allow password with empty username in URLs r?dragana!

Comment 6

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1495313 - Fix xhr/fetch tests to allow passwords with no username in URLs r?baku!

Depends on D11254

Comment 7

[Valentin Gosu [:valentin] (he/him)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=6ad357a3946824e97cdedc998ae02b576bfde917

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9ad299b5161b
Allow empty username in URLs r=dragana

Comment 9

[Andreea Pavel [:apavel]]

Backed out for failing mochitest at dom/security/test/cors/test_CrossSiteXHR.html 

Push that started the fialures: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=9ad299b5161b0cedf852d56365310de499f94043

Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=211739159&repo=autoland&lineNumber=2594

Backout: https://hg.mozilla.org/integration/autoland/rev/1f476b3ce845b4a6385c284734c60fa78b91027c

Comment 10

[Valentin Gosu [:valentin] (he/him)]

(In reply to Andreea Pavel [:apavel] from comment #9)
> Backed out for failing mochitest at
> dom/security/test/cors/test_CrossSiteXHR.html 

It seems I used lando to push the stack, but I pushed only the first commit :)

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ef6d81f0b298
Allow password with empty username in URLs r=dragana
https://hg.mozilla.org/integration/autoland/rev/db95e3b861f4
Fix xhr/fetch tests to allow passwords with no username in URLs r=baku

Comment 12

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/ef6d81f0b298
https://hg.mozilla.org/mozilla-central/rev/db95e3b861f4