2077874 - Nested feed page relative favicon resolves at site root

Status: RESOLVED FIXED

(MailNews Core :: Feed Reader, defect)

Description

[Nguyen Tuan Hung]

Nested feed page relative favicon resolves at site root

Product: MailNews Core
Component: Feed Reader
Type: defect
Tested: Thunderbird Daily 159.0a1, BuildID 20261003100540, Linux x86_64
Tested comm-central revision: fd6ee9a9bd64e360a9dbb737e2d0fab4e395fbf0
Current source check: FeedUtils.sys.mjs at comm-central tip dcee81d8649b4f586d35265dd7cf71fcf7edc40f matched the tested copy byte for byte on 2026-10-04 UTC.
Visibility: public functional issue; no security impact demonstrated.

Steps to reproduce

1. Serve the attached local fixture directory: python3 -m http.server 8765 --bind 127.0.0.1 --directory <fixture-directory>. It contains the two RSS feeds, their HTML pages, and nested/icon.png.
2. In a disposable RSS account, subscribe through Feed Subscriptions to http://127.0.0.1:8765/nested/favicon-relative-feed.xml. Its channel link points to /nested/favicon-relative-case.html, which declares <link rel="icon" href="icon.png">.
3. Check the feed's favicon. Repeat with favicon-absolute-feed.xml; its HTML page differs only in using href="/nested/icon.png".

The expected /nested/icon.png is a valid PNG and returns HTTP 200. Neither /icon.png nor /favicon.ico exists (both return 404).

Expected result

An HTML relative icon URL is resolved against the page URL. Both pages should supply the same icon at http://127.0.0.1:8765/nested/icon.png, and the subscribed feed should obtain it. This follows the HTML Standard's URL resolution for a link's href relative to its document.

Actual result

The relative-link feed subscribes, stores one article and keeps the correct channel link, but FeedUtils.getFavicon(folder, feedURL) returns an empty value. The absolute-path control returns the PNG as a data:image/png;base64,... URL. The same result occurs when getFavicon(null, pageURL) is called directly.

verify_h29.py ran two independent direct calls and two actual Feed Subscriptions UI subscriptions per variant. All eight assertions passed: four relative cases had no icon, while four absolute controls had the icon. All four UI runs subscribed and stored one article. The attached sanitized JSON records the results and local HTTP 200/404 controls. The three relevant favicon preferences were enabled in the direct runs; no third-party resource was requested.

Cause supported by code

FeedUtils.sys.mjs:968-992 parses the page's HTML and, when an icon href has no leading slash, prepends / before appending it to the page origin. For the nested page, this converts icon.png to /icon.png instead of resolving it against /nested/favicon-relative-case.html. fetchFavicon() then fails on the nonexistent root path, and the function returns an empty icon.

Duplicate check

Bug 1853895 fixed relative icon links on a site's index page. The current implementation works for that root-page pattern, but the attached case is a nested page where the same relative href must retain the parent directory. Bug 1838190 addressed icon discovery on a site index page, and fixed bug 1979019 addressed an invalid icon blocking other feeds; neither covers this missing nested-directory resolution. Public open/closed Feed Reader summary and comment searches for favicon, relative icon, nested, iconLink.href, and discoverFaviconURL found no current report of this exact case. Public searches cannot exclude private or differently worded reports.

Format reference: https://html.spec.whatwg.org/multipage/links.html (link href URL resolution).

Credit: Nguyen Tuan Hung ([e-mail]), VNU HCM - UIT

Comment 1

[Nguyen Tuan Hung]

Attachment: Local RSS, HTML and PNG case/control fixtures

Comment 2

[Nguyen Tuan Hung]

Attachment: Sanitized eight-run Thunderbird results

Comment 3

[Wayne Mery (:wsmwk)]

(not a new version issue unless determined otherwise by regression testing)

Comment 4

[Mirko Kerezovic]

Attachment: Bug 2077874 - Resolve relative feed favicons against page URL. r=#thunderbird-reviewers

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/7a89fe2f1a7b
Resolve relative feed favicons against page URL. r=mkmelin