Closed
Bug 815160
Opened 13 years ago
Closed 13 years ago
MSDN keyword search returns incorrect URL
Categories
(Firefox :: Bookmarks & History, defect)
Tracking
()
RESOLVED
INVALID
People
(Reporter: itaypk, Unassigned)
References
()
Details
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0
Build ID: 20121119183901
Steps to reproduce:
1. Go to http://msdn.microsoft.com/en-US/
2. Right click on the top search form -> "Add a keyword for this search..."
3. Use "msdn" as keyword and approve
4. Use the "msdn" smart shortcut, trying to search for anything.
Actual results:
The smart shortcut resolved to "http://socialdsdscom/search/?SearchAction=search&query=%s", probably because the form "action" attribute is defined as "http://socialdsdscom/search/" (and is set later by JS when clicking on the search field).
Firefox then translates the URL to "http://www.socialdsdscom.com/search/?SearchAction=search&query=%s" which is a spam site.
Expected results:
Using the search button leads to "http://social.msdn.microsoft.com/Search/en-US?query=%s" - using the shortcut should lead here.
Component: Untriaged → Bookmarks & History
I can confirm this behavior, however, when I look at the HTML behind this I see:
| <form action="http://socialdsdscom/search/" method="get" name="HeaderSearchForm">
| <input type="hidden" value="search" name="SearchAction"></input>
So the url is coming from Microsoft, this is not a hijack. I don't know why you would code a page this way but it appears to be all over MSDN and Technet.
Group: core-security
Status: UNCONFIRMED → RESOLVED
Closed: 13 years ago
OS: Windows 7 → All
Hardware: x86_64 → All
Resolution: --- → INVALID
Updated•13 years ago
|
Summary: Using "Add a keyword for this search..." feature might be hijacked. → MSDN keyword search returns incorrect URL
Comment 2•13 years ago
|
||
"Add a keyword for this search" not handling forms altered on submission is a valid issue, but I don't think it's one that we can easily fix.
You need to log in
before you can comment on or make changes to this bug.
Description
•