150966 - IP addresses in single decimal values should fail (but work instead)

Status: VERIFIED DUPLICATE of bug 67730

(Camino Graveyard :: General, defect, P4)

Description

[benc]

Chimera 0.3
While running Networking - Core tests

http://www.mozilla.org/quality/networking/testing/coretests.html

STEPS:
http://3486011863 becomes www.mozilla.org.

This should error, b/c it should be treated as a DNS entry, and not found.

See bug 67730.

Comment 1

[Winnie Lam]

*** Bug 150973 has been marked as a duplicate of this bug. ***

Comment 2

[Winnie Lam]

*** Bug 150975 has been marked as a duplicate of this bug. ***

Comment 3

[saari (gone)]

that shoud indeed fail, but isn't high priority just yet

Comment 4

[Mike Pinkerton (not reading bugmail)]

how do we prevent this in mozilla or any other embedding apps? is there
client-side code that handles this? All we're doing is telling necko to load the
url in the urlbar.

cc'ing some necko guys and ccarlen.

Comment 5

[benc]

Previous bugs argued that this was because we blindly call some API (like
gethostbyname), and the quality of the implementation was variable.

I have argued that mozilla/trunk should error bogus DNS stuff and cast the
hostname|IP data at the application level in bug 140379.

Comment 6

[Mike Pinkerton (not reading bugmail)]

can anyone with a mozilla mach-o build verify if this happens there too? if so,
it's a darwin nspr issue, not specific to chimera.

Comment 7

[Ben Lukens]

This seems to indeed be a darwin bug, as even command line apps (under 10.1.5)
will convert a decimal address to to full dotted-quad. As in:

% telnet 3486011863 80
Trying 207.200.81.215...
Connected to 3486011863.
Escape character is '^]'.

Mach-O Mozilla will also connect to mozilla.org through 3486011863, however CFM
Mozilla and Internet Explorer will not.

Comment 8

[Mike Pinkerton (not reading bugmail)]

well then this isn't a chimera bug. file a new one if you disagree with darwin's
nspr impl

Comment 9

[benc]

In all cases where this works, the underlying OS supports a more liberal IP
address  input than the RFC's for the URL. The premise of these bugs, as I
present them, is that we should be doing our own address validity checking in
the application, for standards and security reasons. The depends bug contains
all the details.

As for the Chimera specific bug, I created it as part of my test results, and if
you don't plan on doing a Chimera-only fix, that's completely understandable.
Ideally it should be implemented in the trunk.

Comment 10

[benc]

w/ cfm gone, bug 67730 is now all-plats, and this is a dupe.

Comment 11

[benc]

"Mach-O IS the Camino..."

*** This bug has been marked as a duplicate of 67730 ***