16442 - REFERER shows the local hard drive location of the page you came from

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[Hervé Renault]

version = CVS check out on 1999-10-13

when you have a local page containing a link, hit the link : mozilla transmits
the location of the local page to the server :

test made with /tmp/atest.html that contains <a href="http://localhost/">cliquer
ici</a>

with Mozilla the server log shows :
"GET / HTTP/1.0" 200 1815 "file:///tmp/atest.html" "Mozilla/5.0 [fr-FR] (LINUX;
I)"

with Nav4.x the server log shows :
"GET / HTTP/1.0" 200 1815 "-" "Mozilla/4.61 [en] (X11; I; Linux 2.2.10 i686)"

it may be a security a security hole, because it reveals info about the
structure of your filesystem.

Comment 1

[Gagan]

ouch!

Comment 2

[Hervé Renault]

hi, i've played a bit with gdb and i just would like to know if i've undestood
roughly what is going on :

in nsWebShell.cpp:HandleLinkClickEvent you have

(void)shell->LoadURL(aURLSpec, aPostDataStream,
                     PR_TRUE, nsIChannel::LOAD_NORMAL,
                     0, nsnull, str);

would it be correct to say something like

(void)shell->LoadURL(aURLSpec, aPostDataStream,
                     PR_TRUE, nsIChannel::LOAD_NORMAL,
                     0, nsnull, ( <<aURLSpec is not http:>> ? "-" : str ));

if you see what i mean (i hope this is not too awful, it's just a try ;)

best regards

Comment 3

[Hervé Renault]

sorry, this should be better :

(void)shell->LoadURL(aURLSpec, aPostDataStream,
                     PR_TRUE, nsIChannel::LOAD_NORMAL,
                     0, nsnull, ( <<str begins with http://>> ? str : "-" ));

Comment 4

[Gagan]

thanks for your valuable investigation. Bug reports like these really help us
track and fix bugs faster. Marking for M12.

Comment 5

[leger]

Moving Assignee from gagan to warren since he is away.

Comment 6

[Warren Harris]

Rick, Were you working on Referrer stuff? Can you own this one?

Comment 7

[leger]

Bulk move of all Necko (to be deleted component) bugs to new Networking

component.

Comment 8

[Warren Harris]

Moving Rick's M14 bugs to M13 (since he won't be here for M14). He can triage
them to M15 as appropriate.

Comment 9

[Warren Harris]

I'll take this. We want to add a GetURLAsReferrer method to nsIChannel.

Comment 10

[Warren Harris]

I don't see where we're sending the referrer at all right now.

And file: seems to be broken now too. I'm waiting on Doug's nsIFile branch to
see if file: gets fixed -- then I can go from a file: to an http: URL to see if
a file: referrer ends up in the request.

Finally, I've rethough adding a GetURLAsReferrer and I don't think that's the
right thing to do. I think the right thing is for the referrer to be passed to
AsyncRead (as a nsIURI or nsIChannel), and the http protocol will QI it to see
if it's http:. If not, it won't send it as a referrer.

Reassigning to Gagan for m14, or until we can get the referrer header in the
request.

Comment 11

[Gagan]

I don't see much of Referer header being used either but I have added the check
that it should only be http. will check it in tonite.

Comment 12

[Gagan]

oops... updating eta to the date and not the bug number :)

Comment 13

[Gagan]

fix checked in.

Comment 14

[Tom Everingham]

verified: 
NT 2000021408

hrenault, this should be gone on Linux but if you still see it
please re-open

Comment 15

[Hervé Renault]

it's ok on Linux 2000-02-14-16-M14 binary.
thanks.

Comment 16

[Pulsebot]

Pushed by ffxbld-merge:
https://hg.mozilla.org/releases/mozilla-beta/rev/ef75921c1214
[fenix] For https://github.com/mozilla-mobile/fenix/issues/16442 - Check if fragment is still attached before updating site permissions rules (https://github.com/mozilla-mobile/fenix/pull/16954)