228279 - URL: Links containing control characters are parsed incorrectly (especially NUL)

Status: RESOLVED WORKSFORME

(Core :: Networking, defect)

Description

[Mikko Rantalainen]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6b) Gecko/20031208
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6b) Gecko/20031208

See the URL (test case). All the links point to http://mozilla.org/developer/
but each has differently encoded user name. Note that each link represents the
same user and URL combination but every link behaves differently. Link 1 seems
to lose user name totally (test bytes: "%01","%00"), Link 2 represents the
problem discussed in bug 228176 and resulting page hides the statusbar message
of all relative links on the resulting page (0x01,"%00") and Link 3 goes to
bugzilla.mozilla.org instead (0x01,0x00).

MSIE has some rendering problems (incorrect status and/or address bar) with all
of these, but all the links seem to go where they're supposed to go.


Reproducible: Always

Steps to Reproduce:
1. Open the URL
2. Open all the links (in new windows or tabs)
3. Compare results

Actual Results:  
Every link results to different page and behaviour. Status bar message of every
link is incorrect but that's bug 228176.

Expected Results:  
Every link should result to the same resource. Every link is identical, after
all, but they differ in encoding.

Security problem? I didn't test NUL characters in other places in the page source.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Almost certainly an issue in the URL parser, not the HTML parser... (the latter
doesn't use null-terminated C strings, for one thing, while the former does).

Darin, if the content model is indeed wrong in any of those cases do let me know
and I'll look into it.  But from what I recall of the URL parsing code, the
issue should be there.

Comment 2

[Andreas Otte]

My guess would be the net_CoalesceDirs code in
mozilla/netwerk/base/src/nsURLHelper.cpp which still uses c-strings instead of
the string-classes, one of the last remaining places in necko.  

Comment 3

[Mikko Rantalainen]

It seems that this bug can be closed. It works with
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050619 [Build ID:
2005061903].

The third test link is still broken in Firefox 1.0.4. I didn't try latest trunk
build of Firefox.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Worksforme, per comment 3.