816877 - url not correctly interpreted

Status: RESOLVED INVALID

(Firefox for Android Graveyard :: General, defect)

Description

[hendrick]

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:16.0) Gecko/20100101 Firefox/16.0
Build ID: 20121024073032

Steps to reproduce:

Opened a page containing the following url in the anchor tag

http://www.xyz.com/search.php?search_query=michele+fleur+butterfly&page=4&section=product&ajax=1

MY User agent:
Mozilla/5.0 (Linux; U; Android 4.0.4; en-us; SCH-I535 4G Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30


Actual results:

Url interpreted as

http://www.xyz.com/search.php?search_query=michele+fleur+butterfly&page=4§ion=product&ajax=1


Expected results:

Url should be interpreted as

http://www.xyz.com/search.php?search_query=michele+fleur+butterfly&page=4&section=product&ajax=1

and not

http://www.xyz.com/search.php?search_query=michele+fleur+butterfly&page=4§ion=product&ajax=1

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

Please provide real URLs.

Comment 2

[hendrick]

http://www.certifiedwatchstore.com/search.php?search_query=accutron&x=0&y=0

is the real url, it contains pagination.

which have links as http://www.certifiedwatchstore.com/search.php?search_query=accutron&x=0&y=0&page=2&section=product#results

please have a look.



Mozilla/5.0 (iPhone; CPU iPhone OS 6_0_1 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A523 Safari/8536.25

Comment 3

[Aaron Train [:aaronmt]]

Please indicate which version of Firefox you are testing with.

Comment 4

[Kartikaya Gupta (email:[e-mail])]

The &sect in the anchor URL is being treated as an HTML character reference sequence [1]. This behaviour should happen in any browser (including Firefox) that follows the HTML5 parsing algorithm [2]. Whoever owns the page with the anchor tag needs to fix the page so that the HTML character reference is appropriately escaped. The href value should really be http://www.xyz.com/search.php?search_query=michele+fleur+butterfly&page=4&section=product&ajax=1

[1] http://www.whatwg.org/specs/web-apps/current-work/multipage/named-character-references.html#named-character-references
[2] http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#tokenizing-character-references

Comment 5

[Kartikaya Gupta (email:[e-mail])]

Oh wait, my mistake. I misread the spec - since the HTML character reference is in an attribute value and is followed by an ASCII alphanumeric character it should not be parsed as a character reference. However if that were happening then that would explain the behaviour you are seeing. I cannot reproduce the behaviour on the certifiedwatchstore website.

Comment 6

[Kartikaya Gupta (email:[e-mail])]

Putting back needinfo that got clobbered.

Comment 7

[hendrick]

the error happens with the following user agent, every other browser works fine.

Mozilla/5.0 (iPhone; CPU iPhone OS 6_0_1 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A523 Safari/8536.25

Comment 8

[Kartikaya Gupta (email:[e-mail])]

If it only happens when using a particular user-agent string then it must be a problem with the content being generated by the site. We don't change our link parsing behaviour based on what UA string we're sending.

Also when I load the page on desktop FF using that UA string I'm still unable to reproduce any problem on the browser side. Clicking on the pagination links does return empty pages with the text "Array" which indicates that something is wrong on the server side.

Comment 9

[hendrick]

yes the empty page is because of the error stated above.


this is the log that i got (probably yours)

URL : /search.php?search_query=accutron&x=0&y=0&page=2§ion=product&ajax=1
IP : 66.207.208.98
REF : http://www.certifiedwatchstore.com/search.php?search_query=accutron&x=0&y=0
User Agent : Mozilla/5.0 (iPhone; CPU iPhone OS 6_0_1 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A523 Safari/8536.25



if i var_dump the $_GET

i get 

'search_query' => string 'accutron' (length=8)
  'x' => string '0' (length=1)
  'y' => string '0' (length=1)
  'page' => string '2§ion=product' (length=14)
  'ajax' => string '1' (length=1)

which is obviously what i dont want hence the error.

Comment 10

[hendrick]

here 6 parameters in the url becomes 5.

ie : 
   search.php?search_query=accutron&x=0&y=0&page=2&section=product&ajax=1
becomes: 
   search.php?search_query=accutron&x=0&y=0&page=2§ion=product&ajax=1

Comment 11

[Kartikaya Gupta (email:[e-mail])]

I just tried it again while running Wireshark to see exactly what the browser was sending out, and the request looks perfectly sane (see below). Are you using the PHP htmlentities functions anywhere? It might be a bug in PHP.

POST /search.php?search_query=accutron&x=0&y=0&page=2&section=product&ajax=1 HTTP/1.1
Host: www.certifiedwatchstore.com
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0_1 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A523 Safari/8536.25
Accept: text/html, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: http://www.certifiedwatchstore.com/search.php?search_query=accutron&x=0&y=0
Content-Length: 0
Content-Type: text/plain; charset=UTF-8
Cookie: SHOP_SESSION_TOKEN=j6mv7hruq048bn47io1a44sj06; __utma=82779012.558375110.1354549736.1354633452.1354635684.3; __utmc=82779012; __utmz=82779012.1354549736.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); STORE_VISITOR=1; __utmb=82779012.1.10.1354635684
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 04 Dec 2012 15:31:21 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 697
Connection: close
Content-Type: text/html; charset=UTF-8

Comment 12

[hendrick]

I am not sure if it a php bug or not.

to make the debuging even simple. i suggest another method.

Consider the following html file upload it on a web server and follow a link.

if § is in the address bar then i guess this will be a browser issue.

further, 

you can also use var_dump in the search.php file to see if the desired parameter is passed.

if the parameters are ok then i will need to change my php code.
if § is passed in the address bar then i think it should be considered a bug?.

<html xml:lang="en" lang="en">
<head>
</head>
<body>

<ul class="PagingList">
		<li>Pages:</li>
		<li class="ActivePage">1</li>
		<li><a href="search.php?search_query=accutron&x=0&y=0&page=2&section=product#results">2</a></li>
		<li><a href="search.php?search_query=accutron&x=0&y=0&page=3&section=product#results">3</a></li>
		<li><a href="search.php?search_query=accutron&x=0&y=0&page=4&section=product#results">4</a></li>
		<li><a href="search.php?search_query=accutron&x=0&y=0&page=5&section=product#results">5</a></li>
		<li><a href="search.php?search_query=accutron&x=0&y=0&page=6&section=product#results">6</a></li>
	</ul>
</body>
</html>

Comment 13

[Kartikaya Gupta (email:[e-mail])]

Works fine for me.