343276 - Poor handling of a backslash ("\") in a URL

Status: RESOLVED DUPLICATE of bug 64488

(Firefox :: General, defect)

Description

[Richard Hart]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

If an html web page includes a link that by mistake included a backslash (for example: href="info\july4.html"), the page will be found, if it exists, and loaded. However the URL in the location box shows the backslash translated to %5C (for example ...href="info%5Cjuly4.html"). This then cause every following relative object, link, images, etc. to fail. The bad relative address must be located in a remote server. It would cause a problem on a local PC.

If you support the backslash, you should support the backslash everywhere. If you don't support the backslash here, the initial load the page that included the backslash in the URL should should fail. (It took a while to figure out that the problem was in the address of the page that loaded correctly, and not in the objects that would not load.)

Reproducible: Always

Steps to Reproduce:
1. Create a web page with a backslask in the link in an "a" tag, and also create a web page that the link points to.
2. Upload the two pages to a remote server.
3. load the web page containing the backslash in the link. and click on the link.

Actual Results:  
The page referenced will load, but any images, or links that it contains using relative addressing will fail.

Expected Results:  
Either: (A) The loaded page would load correctly with all images and links functioning properly, or (B) The initial page, loaded when the link containing the backslash is clicked would not load and report a 404 not found error.

My preference is slightly tilted toward outcome (A), as IE just works with both a "/" and with a "\", but I don't like to leave "\"'s in a web page either.

Comment 1

[Matthias Versen [:Matti]]

A Backslash "\" is invalid in an URL, see the RFCs and such a backslash must be escaped as %5C. Another example of an invalid char in an URL is a space which must be escaped as %20.

Only manually entered backslashes in the URL bar will be translated into a "/". This is a simple help for weindows users.
That IE doesn't escape a "\" is a "bug" in IE.

-> invalid (by design)

Comment 2

[Richard Hart]

If the "\" is invalid, as you point out and as I suspected, then the URL should not be accepted as valid initially. The web address containing the "\" should not be displayed by the browser. The URL should from the start be identified as invalid. 

Comment 3

[Ryan Flint [:rflint] (ping via IRC for reviews)]

(In reply to comment #2)
> If the "\" is invalid, as you point out and as I suspected, then the URL should
> not be accepted as valid initially. The web address containing the "\" should
> not be displayed by the browser. The URL should from the start be identified as
> invalid. 
> 
Absolutely not. RFC 1738 explictly states that unsafe characters such as the backslash must be escaped, not dropped or ignored. Simply ignoring such links accomplishes nothing and ignores cases where such a character might be used to describe something other than a path (f.e. session parameters).