Closed Bug 66673 Opened 24 years ago Closed 14 years ago

Reading a newsposting auto subscribes me to invalid newsgroups (images)

Categories

(MailNews Core :: Networking: NNTP, defect)

defect
Not set
major

Tracking

(Not tracked)

RESOLVED WORKSFORME

People

(Reporter: bugzilla, Unassigned)

References

Details

(Keywords: qawanted)

Attachments

(3 files)

This one is weird, but 100% reproduceable: when I read the attached news posting I'm automaticlly subscribed to some invalid newsgroups. Mozilla seems to add the following newsgroups to the rc file: ghettoscooter.jpg: ghettobearings.jpg: ghettofolded.jpg: ghettoelbow.jpg: ghettoknee.jpg: ghettowheel.jpg: thumb_battle.gif: thumb_race.gif: ghetto_scooter.gif: lifeloungead.gif: build 20010126 If you read it in normal mail you get at lot of errors saying: "The specified mailbox does not exist" because mozilla sends invalid commands like 4 select "images/ghetto_scooter.gif"
I've posted the message to "netscape.test" on news.mozilla.org The subject is "bug 66673"
Attached file dangerous mail/news posting (deleted) —
QA Contact: esther → stephend
we must be treating those relative, "schemeless" urls as the the same scheme as current scheme. news://images/ghetto_scooter.gif when in news imap://images/ghetto_scooter.gif when in imap etc.
I think I remember this in one of my log files once, that I verified for David B. I'll go see if I can retrieve it and attach it here.
Why does: 0[2f4010]: Sending: GROUP mozilla-banner.gif0[2f4010]: Next state: NNTP_RESPONSE 0[2f4010]: Receiving: 411 No such group result in the subscribtion of group "mozilla-banner.gif" ? Just doing a "group" command auto subscribe you to that group?
it is the other way around. we are running the news://image/mozilla-banner.gif url and that is causing us to do the GROUP.
*** Bug 68453 has been marked as a duplicate of this bug. ***
Putting on nsbeta for the radar, because often times we get reports of too many connections, and this bug is a cause of that.
Keywords: nsbeta1
marking nsbeta1- for the moment. Seth do you think this would cause "Too Many Connections"?
Keywords: nsbeta1nsbeta1-
Target Milestone: --- → Future
Stephen is correct that this does cause extra connections.
thanks David. marking nsbeta1+ then. It would be good to cut these down.
Keywords: nsbeta1-nsbeta1
Priority: -- → P2
Whiteboard: [nsbeta1+]
Target Milestone: Future → mozilla0.9
moving to mozilla0.9.1
Target Milestone: mozilla0.9 → mozilla0.9.1
harishd, this might be related to #76200
testing this again, hoping the fix to 76200 has fixed it....
Status: NEW → ASSIGNED
the original message from Henrik isn't on netscape.test anymore. I tried posting a similar message (with <img src="foo.gif"> tags) and while I do get assertions (see bug #76600) this bug is fixed. henrik, can you post your evil message again so I can verify? if that works, we can mark this fixed. bienvenu, wasn't there an a similar bug, but for IMAP? (we'd get "folder doesn't exist" or something?)
marking fixed, because the schemeless url problem is fixed. gemal, please verify.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
Seth, usually the Netscape.com Inbox Direct e-mails (with lots of transparent images in their HTML markup) gave "IMAP: Mailbox doesn't exist", so you are correct.
stepehend, can you post the rfc822 from one of those messages, or can you confirm it has schemeless image urls? hopefully your build has the fix for #76200 and that is why it works for you.
I'll try it with tomorrow's build and see if the mailbox does not exist probleme goes away for imap messsages.
Same here. I'm pulling a tree, and subscribing to some Netscape.com newsletters. I'll report back tomorrow.
Reading the original posting on my internal newsserver crashes Mozilla. Running mozilla build 2001041804 Talkback ID: TB29315321Z Talkback ID: TB29315812X Talkback ID: TB29315994K I've also reposted the message to: "netscape.test" on news.mozilla.org The subject is "bug 66673" and the time is "13:21" and it will crash Mozilla.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Henrik: ------- Additional Comments From Seth Spitzer 2001-04-18 18:01 ------- fixed. thanks blizzard. You won't see this fixed until the 19th build (unless you've just pulled.)
Okay with build 2001041904 on Mac, Linux and Win2K, I still see that alert I mentioned. I'll attach the Evil Message (tm).
This line in particular looks whacked to me! <img src=3D"http://i.cheetahmail.com/c= li_img/iwon/20010417/email_02.jpg" width=3D159 height=3D339 usemap=3D"#Map"= border=3D"0"> It's certainly not normal HTML syntax (are they pre-defining a new object or classs here?)
Isn't this just from the MIME encoding of the long URL ('=3D' is '=', and continuation over a line is '=')? The actual tag would be <img src="http://i.cheetahmail.com/cli_img/iwon/20010417/email_02.jpg" width=159 height=339 usemap="#Map" border="0"> which looks valid enough....
The question is does Mozilla know it is MIME encoding?
in todays build I just got this in my LOG: 0[346050]: Receiving: 200 venus.ost.tele.dk Netscape-Collabra/3.54 24102 NNRP ready (posting ok). 0[346050]: Next state: NNTP_SEND_MODE_READER_RESPONSE 0[346050]: Next state: SEND_FIRST_NNTP_COMMAND 0[346050]: Sending: GROUP fd-back.gif 0[346050]: Next state: NNTP_RESPONSE 0[346050]: Receiving: 411 No such group 0[346050]: Next state: SEND_FIRST_NNTP_COMMAND_RESPONSE 0[346050]: group (fd-back.gif) not found, so unset m_currentGroup 0[346050]: Next state: NEWS_ERROR 0[346050]: NEWS_ERROR 0[346050]: Next state: NEWS_FREE
from reading the later comments it looks like this and http://bugzilla.mozilla.org/show_bug.cgi?id=74463 may have become dups of each other.
on my recent build, I tried the evil "bug 66673" post from henrik. I'm getting the asserts in nsIOService (known bug) but this problem is fixed.
Status: REOPENED → RESOLVED
Closed: 24 years ago24 years ago
Resolution: --- → FIXED
based on the nntp log, it looks fixed.
Yes, and we also don't crash. Right now, I'm just checking out Mac and Linux ;-) Then this puppy will get the verified fixed lovin' that's been long overdue!
Verified fixed. Mac 2001050104 and Linux 2001050108
Status: RESOLVED → VERIFIED
I'm getting this again. Please try to read my posting on: server: news.mozilla.org group: netscape.test subject: bug 66673 reading that newsposting will autosubscribe you to the "fd-back.gif" newsgroup. build 20010513 my NNTP log: 0[346198]: Next state: NNTP_READ_ARTICLE 0[346198]: Next state: NEWS_DONE 0[346198]: Next state: NEWS_FREE 0[346198]: CleanupAfterRunningUrl() 0[346198]: Next state: NEWS_FREE 0[346198]: CleanupAfterRunningUrl() 0[346198]: ParseURL 0[346198]: fullPath = /fd-back.gif 0[346198]: m_messageID = (null) 0[346198]: group = fd-back.gif 0[346198]: commandSpecificData = (null) 0[346198]: m_key = -1 0[346198]: Next state: SEND_FIRST_NNTP_COMMAND 0[346198]: Sending: GROUP fd-back.gif 0[346198]: Next state: NNTP_RESPONSE 0[346198]: Receiving: 411 No such group 0[346198]: Next state: SEND_FIRST_NNTP_COMMAND_RESPONSE 0[346198]: group (fd-back.gif) not found, so unset m_currentGroup 0[346198]: Next state: NNTP_ERROR 0[346198]: Next state: NEWS_FREE 0[346198]: CleanupAfterRunningUrl() 0[346198]: ClosingSocket() on nsNNTPProtocol(26d4220) 0[346198]: CleanupAfterRunningUrl()
Status: VERIFIED → REOPENED
Resolution: FIXED → ---
shaver has found something that is probably related. we don't appear to be handling the "Content-Base:" header properly. that would cause this, some of our "relative img url are broken" and "mailbox not found" problems.
reassigning to self.
Assignee: sspitzer → naving
Status: REOPENED → NEW
reassigning back to sspitzer. I didn't see seth's comment earlier, looks like the fix lies outside news code.
Assignee: naving → sspitzer
properly handling content-base should fix this, but there might be more I can do to prevent this until then. I'll try out gemal's latest evil post and see what I can do.
Status: NEW → ASSIGNED
yep, sure enough gemal's evil post causes me to autosubscribe. I'll see what I can cook up...
I'm hoping I can use the news action on the nntp url to tell the difference between displaying a message and a real autosubscribe url. working on it...
actually, I might be able to fix nsNntpService::NewURI() debugging...
hmm, it's not looking so good. while I think NewURI() needs to be fixed in certain cases (see news://news.mozilla.org/9bmgh6%241uc1%40secnews.netscape.com), the spec that comes in partial ("images/gallery_banner.gif") we might need to use aBaseURI to create the proper url. nsNntpUrl::ParseUrl() could also be fixed to parse the url to determine the proper news action. (right now all urls become ActionFetchPart or ActionFetchArticle) for news://news.mozilla.org/3AFFC97E.D2499750%40dk.net, we still get a pure "news://host/group" url when running the message. I don't think there is a proper fix for that until we handle "Content-Base:" properly.
so, instead of some hackery I'm going to work on some other 0.9.1 bugs. thanks for be persistant with this one, henrik. both your evil posts in netscape.test expose real problems.
Depends on: 66402, 77539
moving to 0.9.2
Target Milestone: mozilla0.9.1 → mozilla0.9.2
moving to 0.9.3
Target Milestone: mozilla0.9.2 → mozilla0.9.3
Target Milestone: mozilla0.9.3 → mozilla0.9.4
moving to 0.9.4
slide to 0.9.5
Target Milestone: mozilla0.9.4 → mozilla0.9.5
this bug really stinks. sliding to 0.9.6
Target Milestone: mozilla0.9.5 → mozilla0.9.6
Blocks: 104166
moving to 1.0
Keywords: nsbeta1
Whiteboard: [nsbeta1+]
Target Milestone: mozilla0.9.6 → mozilla1.0
Keywords: nsbeta1nsbeta1+
Target Milestone: mozilla1.0 → mozilla0.9.9
Priority: P2 → P3
moving to 1.0.1
Target Milestone: mozilla0.9.9 → mozilla1.0.1
Blocks: 122274
Keywords: nsbeta1+nsbeta1-
Target Milestone: mozilla1.0.1 → mozilla1.2
Product: MailNews → Core
sorry for the spam. making bugzilla reflect reality as I'm not working on these bugs. filter on FOOBARCHEESE to remove these in bulk.
Assignee: sspitzer → nobody
Status: ASSIGNED → NEW
Filter on "Nobody_NScomTLD_20080620"
QA Contact: stephend → networking.news
Product: Core → MailNews Core
does this still reproduce?
Keywords: qawanted
Priority: P3 → --
Target Milestone: mozilla1.2alpha → ---
This appears to be related to general flaw in handling news: and nntp: URIs as defined in RFC 5538. See <http://www.rfc-editor.org/rfc/rfc5538.txt>. See also bug #16343, bug #41133, bug #77195, bug #175292, bug #215902, bug #224335, and bug #327885; I'm sure there are others.
Trying to generate a message to reproduce on has proved to be difficult, as compose seems to thwart my moves. Trying to reproduce this with a link (which should catch the same bug if it's a relative URI issue) indicates that this no longer reproduces. A trip through CVS blame suggests that bug 77539 fixed this, about the time sspitzer gave up on it (oh the irony). Unless anyone can prove otherwise, this bug is now WFM.
Status: NEW → RESOLVED
Closed: 24 years ago14 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: