312727 - File-not-found HTML downloaded as .exe from members.aol.com

Status: RESOLVED FIXED

(Core Graveyard :: File Handling, defect)

Description

[Martin B. Brilliant]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7

When I click a broken link that points to a missing .exe file on
members.aol.com, the HTML for the file-not-found message is downloaded instead.
The popup dialog window says the file being downloaded is an application, and
the file is saved with the name of the missing .exe file. Then nasty things
happen when the downloaded file is clicked with the mouse. Of course there's a
bug in members.aol.com, but other browsers detect that the file is missing, so
Firefox should also be able to catch the error in members.aol.com.

Reproducible: Always

Steps to Reproduce:
1. Type the URL above (or a similar one at the same site) in the address bar.
2. Hit the Enter key or the Go button.
3. Follow the simple directions in the popup dialog.
4. Rename the downloaded file to (any_name).html (optional).
5. Click or double-click the file.
Actual Results:  
If I did Step 4, Firefox displayed an apology for a missing page. If I omitted
step 4, Windows popped up a message telling me to close all applications and
restart the computer.

Expected Results:  
Firefox should have either
1. displayed the apologetic HTML in the browser window
or
2. popped up a message that the file can't be found.

I reproduced this bug in three different installations of Firefox, on two
Thinkpad laptops running Win98 and a desktop running WinXP Home.

I marked this Normal rather than Minor, even though there's a workaround,
because the user doesn't know there's a need for a workaround until after trying
to execute a non-executable file.

This particular bug could be fixed by notifying AOL that they're doing something
wrong, but that wouldn't prevent others from making the same mistake.

Comment 1

[François Gagné]

$ nc members.aol.com 80
GET /notthere/notthere.exe HTTP/1.0
Accept: text/plain,text/html,*/*

HTTP/1.1 404 Not Found
Date: Mon, 17 Oct 2005 17:42:51 GMT
Server: Apache/1.3.26 (Unix) Resin/2.0.5
Content-Length: 7810
Connection: close
Content-Type: application/octet-stream

(html page skipped)

It's AOL problem, the returned Content-Type: should be text/html

You could always send a email to AOL tech support.

Comment 2

[OstGote!]

the server sends it so:

http://web-sniffer.net/?url=http%3A%2F%2Fmembers.aol.com%2Fnotthere%2Fnotthere.exe&submit=Submit&http=1.1&gzip=yes&type=GET&ua=

So the problem is on AOL's side, looks like a TECH EVANG bug.

Comment 3

[Martin B. Brilliant]

It's not an AOL problem, it's a problem for Firefox users brought about by a
combination of (a) an error by AOL, and (b) failure of Firefox to defend the
user against this error. As I said, other websites could make the same error.

If I were using MSIE I wouldn't have this problem. How does MSIE do it? Not by
blindly relying on the Content-Type. Does the server also return a 404 code? I'm
not that familiar with HTTP, but if MSIE can get it right, so should Firefox.

Comment 4

[Martin B. Brilliant]

François Gagné writes: "You could always send a email to AOL tech support."
No, I can't. AOL support is for AOL members only, and is only about using AOL
software  and services. Maybe you know how to send email to AOL tech support.
After all, this bug affects all Firefox users who try to download missing .exe
files from AOL member websites, not just me.

Comment 5

[François Gagné]

Possible very very ugly hack to check for this problem:

If 404 not found check if the .exe begins with MZ, if not display was a web page.

But I still continue to think it's a AOL problem ;) (nothing personnal)

Comment 6

[Martin B. Brilliant]

I told you I wasn't familiar with HTTP. You're telling me the server really
returned a 404 not found HTTP message. In that case, "If 404 not found check if
the .exe begins with ..." isn't necessary. If you get a 404 not found, then
don't save anything. If the returned file is reported as HTML, you can display
it, otherwise either pop up a message box or display your own not-found page. If
AOL wants to send a pretty apology but doesn't describe it correctly to the user
agent, that's their problem. It becomes your user's problem when you ignore the
404 not found and say you got the file the user asked for.

Comment 7

[Adam Guthrie]

I think you may have a point here, Martin.

Comment 8

[François Gagné]

indeed ;)

and 404 message shouldn't ever be a .exe file.

Comment 9

[Darin Fisher]

cc'ing file handling folk

Comment 10

[Boris Zbarsky [:bzbarsky]]

*** This bug has been marked as a duplicate of 174167 ***

Comment 11

[Christian :Biesinger (don't email me, ping me on IRC)]

no, this is exthandler/uriloader

Comment 12

[Boris Zbarsky [:bzbarsky]]

Ah, hmm.  I guess the question is what to do when we get a 404 that we can't
handle...  Arguably, show an error page (or alert an error if error pages are off).

Comment 13

[Boris Zbarsky [:bzbarsky]]

Attachment: Possible fix

So imo if we get to the point where we're about to call into the helper app handler and we have a failed HTTP request we should probably just bail out.

The NS_ERROR_FILE_NOT_FOUND error seemed best to me here, but if desired I can make up a new error code (and write error page and error alert verbiage for it, etc).  Let me know.

Comment 14

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 219401 [details] [diff] [review]
Possible fix

this is probably ok

Comment 15

[Boris Zbarsky [:bzbarsky]]

Fixed.