1676804 - Path canonicalization incorrectly applied to the query parameters

Status: RESOLVED FIXED

(Toolkit :: Safe Browsing, defect, P2)

Description

[Hector Zhao [:hectorz]]

I'm trying to determine why some urls included in our safe browsing list are not blocked in Fx, and I think there's a client side bug in Fx.

Instead of Canonicalize("http://host.com//twoslashes?more//slashes") = "http://host.com/twoslashes?more//slashes"; as documented by Google, in Fx's browser console:

» let urlUtils = Cc["@mozilla.org/url-classifier/utils;1"].getService(Ci.nsIUrlClassifierUtils);
← <XPCWrappedNative_NoHelper ...>
» urlUtils.getKeyForURI(Services.io.newURI('http://host.com//twoslashes?more//slashes'));
← "host.com/twoslashes?more/slashes"

Note the more//slashes => more/slashes change.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:dimi, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Dimi Lee [:dimi]]

(In reply to Hector Zhao [:hectorz] from comment #0)

I'm trying to determine why some urls included in our safe browsing list are not blocked in Fx, and I think there's a client side bug in Fx.

Thank you for reporting this!

Comment 3

[Dimi Lee [:dimi]]

Attachment: Bug 1676804 - P1. Safe Browsing canonicalization should not include query string r=gcp

Comment 4

[Dimi Lee [:dimi]]

Attachment: Bug 1676804 - P2. Safe Browsing canonicalization should escape # r=gcp

Comment 5

[Dimi Lee [:dimi]]

Attachment: Bug 1676804 - P3. Add testcase r=gcp

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2e19e69edfcb
P1. Safe Browsing canonicalization should not include query string r=gcp
https://hg.mozilla.org/integration/autoland/rev/bf90a5835a15
P2. Safe Browsing canonicalization should escape # r=gcp
https://hg.mozilla.org/integration/autoland/rev/c50c5c214c49
P3. Add testcase r=gcp

Comment 7

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/2e19e69edfcb
https://hg.mozilla.org/mozilla-central/rev/bf90a5835a15
https://hg.mozilla.org/mozilla-central/rev/c50c5c214c49