66673 - Reading a newsposting auto subscribes me to invalid newsgroups (images)

Status: RESOLVED WORKSFORME

(MailNews Core :: Networking: NNTP, defect)

Description

[Henrik Gemal]

This one is weird, but 100% reproduceable:
when I read the attached news posting I'm automaticlly subscribed to some 
invalid newsgroups. Mozilla seems to add the following newsgroups to the rc 
file:
ghettoscooter.jpg: 
ghettobearings.jpg: 
ghettofolded.jpg: 
ghettoelbow.jpg: 
ghettoknee.jpg: 
ghettowheel.jpg: 
thumb_battle.gif: 
thumb_race.gif: 
ghetto_scooter.gif: 
lifeloungead.gif: 

build 20010126

If you read it in normal mail you get at lot of errors saying:
"The specified mailbox does not exist"
because mozilla sends invalid commands like
4 select "images/ghetto_scooter.gif"

Comment 1

[Henrik Gemal]

I've posted the message to "netscape.test" on news.mozilla.org
The subject is "bug 66673"

Comment 2

[Henrik Gemal]

Attachment: dangerous mail/news posting

Comment 3

[(not reading, please use [e-mail] instead)]

we must be treating those relative, "schemeless" urls as the the same scheme as
current scheme.

news://images/ghetto_scooter.gif when in news
imap://images/ghetto_scooter.gif when in imap

etc.

Comment 4

[[e-mail] (gone - use [e-mail] instead)]

I think I remember this in one of my log files once, that I verified for David
B.  I'll go see if I can retrieve it and attach it here.

Comment 5

[[e-mail] (gone - use [e-mail] instead)]

Somehow, we're sending some image files at GROUP commands:

http://bugzilla.mozilla.org/showattachment.cgi?attach_id=22692

Comment 6

[Henrik Gemal]

Why does:
0[2f4010]: Sending: GROUP mozilla-banner.gif0[2f4010]: Next state: NNTP_RESPONSE
0[2f4010]: Receiving: 411 No such group

result in the subscribtion of group "mozilla-banner.gif" ? Just doing a "group" 
command auto subscribe you to that group?

Comment 7

[(not reading, please use [e-mail] instead)]

it is the other way around.

we are running the news://image/mozilla-banner.gif
 url and that is causing us to do the GROUP.

Comment 8

[[e-mail] (gone - use [e-mail] instead)]

*** Bug 68453 has been marked as a duplicate of this bug. ***

Comment 9

[[e-mail] (gone - use [e-mail] instead)]

Putting on nsbeta for the radar, because often times we get reports of too many
connections, and this bug is a cause of that.

Comment 10

[scottputterman]

marking nsbeta1- for the moment. Seth do you think this would cause "Too Many
Connections"?

Comment 11

[David :Bienvenu]

Stephen is correct that this does cause extra connections.

Comment 12

[scottputterman]

thanks David. marking nsbeta1+ then.  It would be good to cut these down.

Comment 13

[scottputterman]

moving to mozilla0.9.1

Comment 14

[(not reading, please use [e-mail] instead)]

harishd, this might be related to #76200

Comment 15

[(not reading, please use [e-mail] instead)]

testing this again, hoping the fix to 76200 has fixed it....

Comment 16

[(not reading, please use [e-mail] instead)]

the original message from Henrik isn't on netscape.test anymore.

I tried posting a similar message (with <img src="foo.gif"> tags) and while I do 
get assertions (see bug #76600) this bug is fixed.

henrik, can you post your evil message again so I can verify?

if that works, we can mark this fixed.

bienvenu, wasn't there an a similar bug, but for IMAP?  (we'd get "folder 
doesn't exist" or something?)

Comment 17

[(not reading, please use [e-mail] instead)]

marking fixed, because the schemeless url problem is fixed.

gemal, please verify.

Comment 18

[[e-mail] (gone - use [e-mail] instead)]

Seth, usually the Netscape.com Inbox Direct e-mails (with lots of transparent 
images in their HTML markup) gave "IMAP: Mailbox doesn't exist", so you are 
correct.

Comment 19

[(not reading, please use [e-mail] instead)]

stepehend, can you post the rfc822 from one of those messages, or can you
confirm it has schemeless image urls?  

hopefully your build has the fix for #76200 and that is why it works for you.

Comment 20

[David :Bienvenu]

I'll try it with tomorrow's build and see if the mailbox does not exist probleme
goes away for imap messsages.

Comment 21

[[e-mail] (gone - use [e-mail] instead)]

Same here.  I'm pulling a tree, and subscribing to some Netscape.com 
newsletters.  I'll report back tomorrow.

Comment 22

[Henrik Gemal]

Reading the original posting on my internal newsserver crashes Mozilla.
Running mozilla build 2001041804

Talkback ID: TB29315321Z
Talkback ID: TB29315812X
Talkback ID: TB29315994K

I've also reposted the message to:
"netscape.test" on news.mozilla.org

The subject is "bug 66673" and the time is "13:21" and it will crash Mozilla.

Comment 23

[[e-mail] (gone - use [e-mail] instead)]

Henrik: ------- Additional Comments From Seth Spitzer 2001-04-18 18:01 -------

fixed.

thanks blizzard.  You won't see this fixed until the 19th build (unless you've 
just pulled.)

Comment 24

[[e-mail] (gone - use [e-mail] instead)]

Okay with build 2001041904 on Mac, Linux and Win2K, I still see that alert I
mentioned.  I'll attach the Evil Message (tm).

Comment 25

[[e-mail] (gone - use [e-mail] instead)]

Attachment: Evil Message from Dell!

Comment 26

[[e-mail] (gone - use [e-mail] instead)]

This line in particular looks whacked to me!

<img src=3D"http://i.cheetahmail.com/c=
li_img/iwon/20010417/email_02.jpg" width=3D159 height=3D339 usemap=3D"#Map"=
 border=3D"0">

It's certainly not normal HTML syntax (are they pre-defining a new object or
classs here?)

Comment 27

[Peter Janes]

Isn't this just from the MIME encoding of the long URL ('=3D' is '=', and
continuation over a line is '=')?  The actual tag would be

<img src="http://i.cheetahmail.com/cli_img/iwon/20010417/email_02.jpg" width=159
height=339 usemap="#Map" border="0">

which looks valid enough....

Comment 28

[Jacek Piskozub]

The question is does Mozilla know it is MIME encoding?

Comment 29

[Henrik Gemal]

in todays build I just got this in my LOG:

0[346050]: Receiving: 200 venus.ost.tele.dk Netscape-Collabra/3.54 24102 NNRP 
ready (posting ok).
0[346050]: Next state: NNTP_SEND_MODE_READER_RESPONSE
0[346050]: Next state: SEND_FIRST_NNTP_COMMAND
0[346050]: Sending: GROUP fd-back.gif
0[346050]: Next state: NNTP_RESPONSE
0[346050]: Receiving: 411 No such group
0[346050]: Next state: SEND_FIRST_NNTP_COMMAND_RESPONSE
0[346050]: group (fd-back.gif) not found, so unset m_currentGroup
0[346050]: Next state: NEWS_ERROR
0[346050]: NEWS_ERROR
0[346050]: Next state: NEWS_FREE

Comment 30

[scottputterman]

from reading the later comments it looks like this and
http://bugzilla.mozilla.org/show_bug.cgi?id=74463 may have become dups of each
other.

Comment 31

[(not reading, please use [e-mail] instead)]

on my recent build, I tried the evil "bug 66673" post from henrik.

I'm getting the asserts in nsIOService (known bug) but this problem is fixed.

Comment 32

[[e-mail] (gone - use [e-mail] instead)]

Attachment: The latest NNTP from a CVS pull on Win2k, reading netscape.test (Henrik's posting)

Comment 33

[(not reading, please use [e-mail] instead)]

based on the nntp log, it looks fixed.

Comment 34

[[e-mail] (gone - use [e-mail] instead)]

Yes, and we also don't crash.  Right now, I'm just checking out Mac and Linux ;-)
Then this puppy will get the verified fixed lovin' that's been long overdue!

Comment 35

[[e-mail] (gone - use [e-mail] instead)]

Verified fixed. Mac 2001050104 and Linux 2001050108

Comment 36

[Henrik Gemal]

I'm getting this again. Please try to read my posting on:
server: news.mozilla.org
group: netscape.test
subject: bug 66673

reading that newsposting will autosubscribe you to the "fd-back.gif" newsgroup.

build 20010513

my NNTP log:
0[346198]: Next state: NNTP_READ_ARTICLE
0[346198]: Next state: NEWS_DONE
0[346198]: Next state: NEWS_FREE
0[346198]: CleanupAfterRunningUrl()
0[346198]: Next state: NEWS_FREE
0[346198]: CleanupAfterRunningUrl()
0[346198]: ParseURL
0[346198]: fullPath = /fd-back.gif
0[346198]: m_messageID = (null)
0[346198]: group = fd-back.gif
0[346198]: commandSpecificData = (null)
0[346198]: m_key = -1
0[346198]: Next state: SEND_FIRST_NNTP_COMMAND
0[346198]: Sending: GROUP fd-back.gif
0[346198]: Next state: NNTP_RESPONSE
0[346198]: Receiving: 411 No such group
0[346198]: Next state: SEND_FIRST_NNTP_COMMAND_RESPONSE
0[346198]: group (fd-back.gif) not found, so unset m_currentGroup
0[346198]: Next state: NNTP_ERROR
0[346198]: Next state: NEWS_FREE
0[346198]: CleanupAfterRunningUrl()
0[346198]: ClosingSocket() on nsNNTPProtocol(26d4220)
0[346198]: CleanupAfterRunningUrl()

Comment 37

[[e-mail] (gone - use [e-mail] instead)]

Sigh, not this bug again. ;-(

Comment 38

[(not reading, please use [e-mail] instead)]

shaver has found something that is probably related.

we don't appear to be handling the "Content-Base:" header properly.

that would cause this, some of our "relative img url are broken" and "mailbox 
not found" problems.

Comment 39

[Navin Gupta]

reassigning to self. 

Comment 40

[Navin Gupta]

reassigning back to sspitzer. I didn't see seth's comment earlier, looks like 
the fix lies outside news code. 

Comment 41

[(not reading, please use [e-mail] instead)]

properly handling content-base should fix this, but there might be more I can 
do to prevent this until then.

I'll try out gemal's latest evil post and see what I can do.

Comment 42

[(not reading, please use [e-mail] instead)]

yep, sure enough gemal's evil post causes me to autosubscribe.

I'll see what I can cook up...

Comment 43

[(not reading, please use [e-mail] instead)]

I'm hoping I can use the news action on the nntp url to tell the difference 
between displaying a message and a real autosubscribe url.

working on it...

Comment 44

[(not reading, please use [e-mail] instead)]

actually, I might be able to fix nsNntpService::NewURI()

debugging...

Comment 45

[(not reading, please use [e-mail] instead)]

hmm, it's not looking so good.

while I think NewURI() needs to be fixed in certain cases (see 
news://news.mozilla.org/9bmgh6%241uc1%40secnews.netscape.com), the spec that 
comes in partial ("images/gallery_banner.gif") we might need to use aBaseURI to 
create the proper url.

nsNntpUrl::ParseUrl() could also be fixed to parse the url to determine the 
proper news action.  (right now all urls become ActionFetchPart or 
ActionFetchArticle)

for news://news.mozilla.org/3AFFC97E.D2499750%40dk.net, we still get a 
pure "news://host/group" url when running the message.  I don't think there is 
a proper fix for that until we handle "Content-Base:" properly.

Comment 46

[(not reading, please use [e-mail] instead)]

so, instead of some hackery I'm going to work on some other 0.9.1 bugs.

thanks for be persistant with this one, henrik.

both your evil posts in netscape.test expose real problems. 

Comment 47

[scottputterman]

moving to 0.9.2

Comment 48

[scottputterman]

moving to 0.9.3

Comment 49

[scottputterman]

moving to 0.9.4

Comment 50

[(not reading, please use [e-mail] instead)]

slide to 0.9.5

Comment 51

[(not reading, please use [e-mail] instead)]

this bug really stinks.  sliding to 0.9.6

Comment 52

[scottputterman]

moving to 1.0

Comment 53

[scottputterman]

moving to 1.0.1

Comment 54

[(not reading, please use [e-mail] instead)]

sorry for the spam.  making bugzilla reflect reality as I'm not working on these bugs.  filter on FOOBARCHEESE to remove these in bulk.

Comment 55

[Serge Gautherie (:sgautherie)]

Filter on "Nobody_NScomTLD_20080620"

Comment 56

[Wayne Mery (:wsmwk)]

does this still reproduce?

Comment 57

[David E. Ross]

This appears to be related to general flaw in handling news: and nntp: URIs as defined in RFC 5538.  See <http://www.rfc-editor.org/rfc/rfc5538.txt>.  

See also bug #16343, bug #41133, bug #77195, bug #175292, bug #215902, bug #224335, and bug #327885; I'm sure there are others.

Comment 58

[Joshua Cranmer [:jcranmer]]

Trying to generate a message to reproduce on has proved to be difficult, as compose seems to thwart my moves. Trying to reproduce this with a link (which should catch the same bug if it's a relative URI issue) indicates that this no longer reproduces.

A trip through CVS blame suggests that bug 77539 fixed this, about the time sspitzer gave up on it (oh the irony). Unless anyone can prove otherwise, this bug is now WFM.