254249 - Malformed/mistyped URL causes browser to scan through history & open random site

Status: VERIFIED DUPLICATE of bug 231720

(Firefox :: General, defect)

Description

[Mike Johnson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2

Upon pasting a malformed/mistyped link into the addressbar (
http://https//student.santarosa.edu/~jdemello/homework.html ) Firefox v0.9.2
quickly linked to several websites in succession, finally settling on
https://www.paypal.com/ and opening it.  In IE, the same malformed/mistyped link
causes a standard "The page cannot be displayed" page to be displayed.

Reproducible: Always
Steps to Reproduce:
1. Cut/Paste the following link into the addressbar - DO NOT correct the mistake
in the URL
2. http://https//student.santarosa.edu/~jdemello/homework.html
3. Hit enter and watch the activity in the Status Bar

Actual Results:  
The status bar indicated that the browser was accessing several webpages in very
quick succession, including http://www.google.com, before settling on
https://www.paypal.com/.

Expected Results:  
Displayed some sort of message indicating that the URL that was entered contains
errors or is invalid.

I have marked this as a security problem because it occurs to me that this
simple bug could potentially be used maliciously by a web site owner.

about:buildconfig

Build platform
target
i686-pc-cygwin

Build tools
Compiler 	Version 	Compiler flags
$(CYGWIN_WRAPPER) cl 	12.00.8804 	-TC -nologo -W3 -nologo -Gy -Fd$(PDBFILE)
$(CYGWIN_WRAPPER) cl 	12.00.8804 	-TP -nologo -W3 -nologo -Gy -Fd$(PDBFILE)

Configure arguments
--disable-ldap --disable-mailnews
--enable-extensions=cookie,xml-rpc,xmlextras,pref,transformiix,universalchardet,typeaheadfind,webservices,inspector,gnomevfs,negotiateauth
--enable-crypto --disable-composer --enable-single-profile
--disable-profilesharing --enable-optimize --disable-debug --disable-tests
--enable-static --disable-shared --enable-official-branding

Comment 1

[Jesse Ruderman]

This happens because Paypal is the first hit on Google for "https".

*** This bug has been marked as a duplicate of 230905 ***

Comment 2

[Owen Marshall (Not reading bugmail)]

hm, this is a dupe, but not of that specific bug.

Comment 3

[Jesse Ruderman]

Owen, if you're going to add DUPEME, you should reopen too.  But why isn't this
a dup of that bug?

Comment 4

[Mike Johnson]

I looked at 230905 - this bug has completely different behavior. Nothing is
changed or added with the URL I type in, it was already a bad URL.

Comment 5

[Jesse Ruderman]

This bug:
Entering http://https/ goes to http://www.paypal.com/ via Google IF.

Bug 230905:
Entering http://test/ goes to http://www.test.com/ by adding www and com.

Ok, maybe they're not the same bug.

Comment 6

[Owen Marshall (Not reading bugmail)]

I know it is a dupe, though... but I can't find it :/ still looking

Comment 7

[Tuukka Tolvanen (sp3000)]

*** Bug 263191 has been marked as a duplicate of this bug. ***

Comment 8

[:Gavin Sharp [email: [e-mail]]]

*** This bug has been marked as a duplicate of 231720 ***

Comment 9

[:Gavin Sharp [email: [e-mail]]]

Verifying old and obvious dupes. Sorry for bugspam.