727495 - Corrupted Content Error on internal University of Waterloo website

Status: RESOLVED DUPLICATE of bug 742174

(Core :: Networking: HTTP, defect)

Description

[Owen Coutts [:tallOwen]]

A website quest.uwaterloo.ca, returns a Corrupted Content Error upon login. This is a regression as it seems to work on the release branch. I sit in mountain view with the webdevs if anyone needs my help triaging this.

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

Getting a http log of the connection would be helpful. https://developer.mozilla.org/en/HTTP_Logging

Comment 2

[Owen Coutts [:tallOwen]]

Attachment: http log

Comment 3

[Matthias Versen [:Matti]]

Is this the issue ?
nsHttpTransaction::ParseLine [Location: ]

Comment 4

[Boris Zbarsky [:bzbarsky]]

Yep.  That response is not distinguishable from a header-splitting attack, iirc.  Patrick, can we mark this blocking the bug where we disallowed such responses?

Owen, would you be willing to contact the site maintainer?

Comment 5

[Patrick McManus [:mcmanus]]

A null location header is both out of spec and carries with it an exploitable response smuggling attack - so we don't honor responses that carry it.

it would be great if you could contact the server admins.

(In reply to Boris Zbarsky (:bz) from comment #4)
> Yep.  That response is not distinguishable from a header-splitting attack,
> iirc.  Patrick, can we mark this blocking the bug where we disallowed such
> responses?

the original bug is still security-screened.. while it waits for a cve I think.

Comment 6

[Boris Zbarsky [:bzbarsky]]

OK.  As long as we have _some_ way to track the issues, I don't care what that way is.

Comment 7

[Jason Duell]

Fixed by 742174: by popular demand we are now allowing empty Location headers again.