Closed Bug 815160 Opened 13 years ago Closed 13 years ago

MSDN keyword search returns incorrect URL

Categories

(Firefox :: Bookmarks & History, defect)

17 Branch
defect
Not set
normal

Tracking

()

RESOLVED INVALID

People

(Reporter: itaypk, Unassigned)

References

()

Details

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 Build ID: 20121119183901 Steps to reproduce: 1. Go to http://msdn.microsoft.com/en-US/ 2. Right click on the top search form -> "Add a keyword for this search..." 3. Use "msdn" as keyword and approve 4. Use the "msdn" smart shortcut, trying to search for anything. Actual results: The smart shortcut resolved to "http://socialdsdscom/search/?SearchAction=search&query=%s", probably because the form "action" attribute is defined as "http://socialdsdscom/search/" (and is set later by JS when clicking on the search field). Firefox then translates the URL to "http://www.socialdsdscom.com/search/?SearchAction=search&query=%s" which is a spam site. Expected results: Using the search button leads to "http://social.msdn.microsoft.com/Search/en-US?query=%s" - using the shortcut should lead here.
Component: Untriaged → Bookmarks & History
I can confirm this behavior, however, when I look at the HTML behind this I see: | <form action="http://socialdsdscom/search/" method="get" name="HeaderSearchForm"> | <input type="hidden" value="search" name="SearchAction"></input> So the url is coming from Microsoft, this is not a hijack. I don't know why you would code a page this way but it appears to be all over MSDN and Technet.
Group: core-security
Status: UNCONFIRMED → RESOLVED
Closed: 13 years ago
OS: Windows 7 → All
Hardware: x86_64 → All
Resolution: --- → INVALID
Summary: Using "Add a keyword for this search..." feature might be hijacked. → MSDN keyword search returns incorrect URL
"Add a keyword for this search" not handling forms altered on submission is a valid issue, but I don't think it's one that we can easily fix.
You need to log in before you can comment on or make changes to this bug.