305978 - onunload trap - View Source shows the URL you tried to load, not the URL that was loaded

Status: RESOLVED DUPLICATE of bug 253497

(Toolkit :: View Source, defect)

Description

[Tobias Boonstoppel]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

after leaving the site (onunload). it may not be possible to redirect the page
somewhere else.



Reproducible: Always

Steps to Reproduce:
1. load the unload.html to into your browser
2. type new address into your addressbar

Actual Results:  
the browser redirects to the url defined in the onunlad function

Expected Results:  
ignore redirectings after manually leaving the site...?

Comment 1

[Tobias Boonstoppel]

if you "view the source" after the redirect. you see the source of page you
typed into your addressbar.

Comment 2

[Tobias Boonstoppel]

Attachment: html file with the javascript onunload event

if you view the source-code after the page redirected. you see the source of
the page you typed into addressbar. but you see the page the browser redirected
to.

Comment 3

[Jesse Ruderman]

This is mostly a dup of bug 251944.  I'm morphing this bug to only cover the
View Source issue, which isn't mentioned in bug 251944.  

Confirmed with Firefox 1.0.6 on Mac.

I can reproduce the trapping effect on the Gecko 1.8 branch (Aug 25), but view
source works properly there.

Bug 278418 is related.

Comment 4

[Jesse Ruderman]

I filed bug 305995 on a Gecko1.8/trunk crash with the same testcase.

Comment 5

[Daniel Veditz [:dveditz]]

I still see the same view-source issue with Firefox 1.5 using the attached testcase. Is this really a security issue? A site could use it in an attempt to obscure their source code (by forcing you through some other site first) but that's pretty weak (the web-developer extension "view-source" feature sees right through it, as would something like wget).

Can we clear the security flag?

Comment 6

[Jesse Ruderman]

I'm not too worried about the fact that you see the wrong stuff when you View Source.  I'm more worried that things other than View Source might get the page's URL in the same way.