237207 - No definite length for the test to be searched in bookmarks manager

Status: VERIFIED DUPLICATE of bug 237085

(Firefox :: Bookmarks & History, defect)

Description

[Tauhida Parveen]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040210 Firefox/0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040210 Firefox/0.8

The search input box in the bookmark manager window is no definite limit on the
length of the string that can be searched for. the search string that I used as
my input is 51200 characters long. when this input was used as an input, nothing
was shown in the input box indicating as if the input was not accepted. When the
input box was highlighted, only then the input string is shown. 

This bug was found when usign Firefox 0.8 on Windows XP

Reproducible: Always
Steps to Reproduce:
1. Select Firefox 0.8
2. select Bookmarks from the toolbar and select Manage Bookmarks
3. On the bookmark manager window, select the search input box and enter a very
long string (e.g 51200 character long). press enter
4. Nothing is shown on the search input box. Highlight any section of the search
input box and you will be able to see the string

Actual Results:  
The search input box accepted the long string but did not display the string.

Expected Results:  
The search input box should have stooped accepting test after a certain number
of characters. Also since it accpeted it, should display the string in the input
box.

Comment 1

[Tauhida Parveen]

Attachment: This is the string I used to test the search input box

Comment 2

[Mike Connor [:mconnor]]

I think anyone would admit its insane to think of anyone in any usage profile
trying to search on a 45000+ character string

However, the search textbox could easily be constrained to a fixed number of
characters, which does make sense.

Comment 3

[Jesse Ruderman]

IMO, this is a dup of bug 203964 and should not be fixed by making this search
field have a maximum length.

Comment 4

[Cem Kaner]

(In reply to comment #2)
> I think anyone would admit its insane to think of anyone in any usage profile
> trying to search on a 45000+ character string
> 
> However, the search textbox could easily be constrained to a fixed number of
> characters, which does make sense.

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7b) Gecko/20040403
Firefox/0.8.0+ (replicated on a Mac, pasting a 10-million-character string)

Why do we test with such crazy numbers? 

In terms of risk: (a) Because programs fail with them dismayingly often, and (b)
because exploitation of constraint-related errors (most notably buffer overrun
attacks) are among the most common successful penetration attacks on software.

In terms of usage profile, there are two "common" profiles: (a) user error in
which the user starts with a big string on the clipboard, selects a small search
string but somehow fails to copy it, then pastes into the search field thinking
s/he is pasting the selected text rather than the original huge string.
Cutting/pasting errors are common user errors, even among very experienced
users. The second usage profile is the hostile user, executing a scripted
attack. As firebird gets more popular, some of the folks who love to show the
holes in Exploder will decide that it's Firebird's turn for some fun.

I read some of the discussion in bugs 203964 and 237085. Given the technical
issues raised in those discussions, I have no good advice as to the solution. My
only point here is to explain that extreme cases are more interesting than they
initially seem to be.

Comment 5

[Asa Dotzler [:asa]]

*** This bug has been marked as a duplicate of 237085 ***

Comment 6

[Mike Connor [:mconnor]]

sorry for bugspam, long-overdue mass reassign of ancient QA contact bugs, filter on "beltznerLovesGoats" to get rid of this mass change