301109 - Feed / folder with title that includes ? results in "File not Found" error

Status: RESOLVED INVALID

(MailNews Core :: Feed Reader, defect)

Description

[Mike Beltzner [:beltzner, not reading bugmail]]

To reproduce:
1. Subscribe to an RSS feed
2. Change the folder title to include a "?"
3. Select an entry from the RSS feed

Actual results:
The user sees the following error in the article summary pane (I've cut and
pasted an example, but obviously the path would depend on the OS, profile name,
and name of the RSS feed):

File Not Found Error
 
The file /Users/beltzner/Library/Thunderbird/Profiles/6t8trroi.default/Mail/News
& Blogs/Friends.sbd/blarg?test?number=1660 cannot be found. Please check the
location and try again.

The file specified by the address (URL) cannot be found. Check that the file
exists and that you have sufficient permissions to view it.

Expected Results:
That the selected RSS entry would be shown.

Comment 1

[Mike Beltzner [:beltzner, not reading bugmail]]

I should note that this seems like a regression; feeds with ? in the title work
in Thunderbird 1.0+.

Comment 2

[Tuukka Tolvanen (sp3000)]

confirmed linux tb trunk 20050714. also happens with local mail folders.

Comment 3

[Tuukka Tolvanen (sp3000)]

ref bug 301109, bug 264485, bug 41944, bug 124287

Comment 4

[Tuukka Tolvanen (sp3000)]

(In reply to comment #1)
> I should note that this seems like a regression; feeds with ? in the title work
> in Thunderbird 1.0+.

1.0+ is a long time span... not working for me in 1.0 either with 1.0 on linux
-- fails silently without error messages, there, though.

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

> 1.0+ is a long time span... not working for me in 1.0 either with 1.0 on linux
> -- fails silently without error messages, there, though.

Yeah, let me correct that. This is a regression for *RSS Feeds* compared to
v1.0.x. (That's likely to do with the fact that 1.1 seems to treat RSS feeds
like local folders) The bugs that are referenced in comment 3 lead me to believe
that the local folders issue has been around for a long time, so this is
probably a dupe of bug 41944, although that seems to imply that it was at one
point fixed?

Comment 6

[Jesse Ruderman]

Is this a security hole?  Could an attacker cause a different file to be
displayed by choosing a name cleverly and encouraging you to use its name as a
folder name?

Comment 7

[Tuukka Tolvanen (sp3000)]

here's a quick strace snippet, that might help answer that to some extent (dups,
non-stat/open/unlinks and path components omitted):

stat64(".../Local Folders/debian?lists", {st_mode=S_IFREG|0600,
st_size=20136161, ...}) = 0
stat64(".../Local Folders/debian?lists.msf", {st_mode=S_IFREG|0644,
st_size=651747, ...}) = 0
stat64(".../Local Folders/debian.msf", 0xbfffa134) = -1 ENOENT (No such file or
directory)
unlink(".../Local Folders/debian.msf") = -1 ENOENT (No such file or directory)
open(".../Local Folders/debian", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file
or directory)

Comment 8

[Magnus Melin [:mkmelin]]

*** Bug 312589 has been marked as a duplicate of this bug. ***

Comment 10

[alta88]

no longer valid; reopen if reproduceable.