294212 - META refresh pointing to an image URL loads image even if "Load Images" is unchecked

Status: RESOLVED INVALID

(Firefox :: General, defect)

Description

[Martin Diers]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

When a META refresh tag appears in the body of an HTML document, and points to a
URL containing an image, the image is loaded, even if "Load images" is unchecked
in Options.

Reproducible: Always

Steps to Reproduce:




In the instance in question with which I discovered this, a malicious user had
injected an META refresh tag as the body of an ad appearing on a freebie
giveaway site. Because the site was not properly filtering their input, the
browser was redirected to a picture of a donkey (Could have been worse ;-) ). In
trying to track down the cause of this behavior, I disabled "Load Images", but
to no avail. The redirect took place anyway, which is to be expected, but the
image should not have loaded.

Comment 1

[:Gavin Sharp [email: [e-mail]]]

The "Load Images" pref doesn't block loading images directly, so a redirect to
an image isn't blocked either.