351689 - meta refresh with Url=//rpsv/... tries to go to a server named "rpsv" instead of the "rpsv" directory on the same server

Status: UNCONFIRMED

(Core :: DOM: Navigation, defect)

Description

[Ask Holme]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6

The attached session shows firefox doing a google im feeling lucky search instead of refresh to the correct url. Live demo is not possible, the problem occoured trying to access a statistical database using university remote access. So logins can't be given out.


http://80-new.sourceoecd.org.p-p-f.proxy.kb.dk/

GET / HTTP/1.1
Host: 80-new.sourceoecd.org.p-p-f.proxy.kb.dk
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.kb.dk/elib/baser/databases.jsp?subject=root-socialscience&q=&ref=&first=s
Cookie: MODCASID=JBkBVzFSWhf33CqCBoxmRaNgWRV6f

HTTP/1.x 200 OK
Date: Thu, 07 Sep 2006 17:26:12 GMT
Server: Apache/1.3.27 (Unix) mod_perl/1.27 mod_ssl/2.8.14 OpenSSL/0.9.7b
Content-Length: 152
Client-Response-Num: 1
refresh: 0; Url=http://80-new.sourceoecd.org.p-p-f.proxy.kb.dk//rpsv/home.htm
Title: SourceOECD
Accept-Ranges: none
Keep-Alive: timeout=5, max=25
Connection: Keep-Alive
Content-Type: text/html
----------------------------------------------------------
http://www.google.com/search?btnI=I%27m+Feeling+Lucky&ie=UTF-8&oe=UTF-8&q=rpsv

GET /search?btnI=I%27m+Feeling+Lucky&ie=UTF-8&oe=UTF-8&q=rpsv HTTP/1.1

Reproducible: Always

Steps to Reproduce:
1. make a page sending a similar refresh to client
2. load it
3. 

Actual Results:  
google search 

Expected Results:  
refresh to correct url.

http://80-new.sourceoecd.org.p-p-f.proxy.kb.dk/

GET / HTTP/1.1
Host: 80-new.sourceoecd.org.p-p-f.proxy.kb.dk
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.kb.dk/elib/baser/databases.jsp?subject=root-socialscience&q=&ref=&first=s
Cookie: MODCASID=JBkBVzFSWhf33CqCBoxmRaNgWRV6f

HTTP/1.x 200 OK
Date: Thu, 07 Sep 2006 17:26:12 GMT
Server: Apache/1.3.27 (Unix) mod_perl/1.27 mod_ssl/2.8.14 OpenSSL/0.9.7b
Content-Length: 152
Client-Response-Num: 1
refresh: 0; Url=http://80-new.sourceoecd.org.p-p-f.proxy.kb.dk//rpsv/home.htm
Title: SourceOECD
Accept-Ranges: none
Keep-Alive: timeout=5, max=25
Connection: Keep-Alive
Content-Type: text/html
----------------------------------------------------------
http://www.google.com/search?btnI=I%27m+Feeling+Lucky&ie=UTF-8&oe=UTF-8&q=rpsv

GET /search?btnI=I%27m+Feeling+Lucky&ie=UTF-8&oe=UTF-8&q=rpsv HTTP/1.1

Comment 1

[David Bloom]

What extensions do you have installed? Try restarting Firefox in safe mode so that the extensions are turned off and see if you can reproduce the problem.

Firefox will add something like "&sourceid=navclient" to the URL for the "I'm Feeling Lucky" searches it performs. Since that isn't happening in your case, I have a hunch that an extension is causing this behavior.

Comment 2

[Eli Friedman]

It's pretty easy to come up with a testcase:
data:text/html,<meta http-equiv="Refresh" content="0;url=http://asdf">
On FF 1.5, this takes you to asdf.com.

I'm pretty sure this is already fixed, but I don't have a recent FF nightly installed at the moment.  Someone should check if it's fixed there.

Comment 3

[Eli Friedman]

(In reply to comment #2)
> It's pretty easy to come up with a testcase:
> data:text/html,<meta http-equiv="Refresh" content="0;url=http://asdf">
> On FF 1.5, this takes you to asdf.com.

Actually, looking a bit more carefully, I'm not sure if that testcase matches the bug here.  There might be something else going on here as well.  But it's my best guess without a server to test against.

Comment 4

[Ask Holme]

I tried testing in safemode in which the bug persists. 
I then looked tried again with extensions on and looked and the generator part of live http headers. It appers that firefox uppon recieving the refresh first tries to load http://rpsv/home.htm which isn't a valid url and causes the google search. 
From the request generator capture:
#request# GET http://80-new.sourceoecd.org.p-p-f.proxy.kb.dk/
#request# GET http://rpsv/home.htm
#request# GET http://www.google.com/search?btnI=I%27m+Feeling+Lucky&ie=UTF-8&oe=UTF-8&q=rpsv

Comment 5

[Ask Holme]

For further analysis i tried capturing the problematic page with wireshark and winpcap. This shows that the cause of this error is the following META REFRESH 
<META CONTENT="0; Url=//rpsv/home.htm" HTTP-EQUIV="REFRESH">

Which firefox interprints as http://rpsv/home.htm instead of http://hostname//rpsv/home.htm 
I have no knowledge of what HTTP Protocol standard and the various RFCs have to say on this point. However i have allways learned that one was to prefix the full protocol name (ie. http://) in the url for the browser to leave the current domain. 

I am aware that //rpsv/home.htm isn't a full compliant URL - however i could belive a double slash to be a quite common error and knowing that Internet Explorer reads this "correctly" i would suggest that firefox has similiar behavoiur for the ease of users (most admins won't care to fix the problem).  


Anyway upen accessing the site (using the correct url) i discovered that sourceOECD contains IE only scripting, so fixing the bug for this webpage only 
is useless.  :)

Comment 6

[timeless]

seems like not much of a bug. this stuff is generally not fully specified so you really shouldn't send it.

garbage in, garbage or other surprises out.

Comment 7

[timeless]

is HTTP/1.x 200 OK valid? it seems bogus to me, but hey, I only worked on one commercial proxy in my life.

Comment 8

[Jesse Ruderman]

Firefox trunk says "Firefox can't find the server at rpsv." instead of doing an I'm Feeling Lucky search.  This change is probably due to the fix for bug 263213.

I can confirm that the testcase in comment 5 tries to go to a server named "rpsv" rather than going to a directory named "rpsv" on the same server.  But that's expected if you treat meta refreshes the same way as <a href>.

Comment 9

[Alex Xu]

Help being provided, 7 years later:

A URL starting with "/" is a server-relative URL; it refers to a file on the current host. From "http://host/dir/page1", "/page2" refers to "http://host/page2".

A URL starting with "//" is a protocol-relative URL; from "http://host/page1", "//host2/page2" refers to "http://host2/page2", but from "https://host/page1", "//host2/page2" refers to "https://host2/page2".

RESOLVED INVALID?