This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 6824 - Redirections: parsing of the Location HTTP header may raise HTTP_RESPONSE-5 incorrectly
Summary: Redirections: parsing of the Location HTTP header may raise HTTP_RESPONSE-5 i...
Status: RESOLVED FIXED
Alias: None
Product: mobileOK Basic checker
Classification: Unclassified
Component: Java Library (show other bugs)
Version: unspecified
Hardware: Other All
: P2 minor
Target Milestone: ---
Assignee: Abel Rionda
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-04-16 13:31 UTC by fd
Modified: 2009-04-30 11:56 UTC (History)
0 users

See Also:


Attachments

Description fd 2009-04-16 13:31:29 UTC
HTTP_RESPONSE-5 is a warning that should be raised whenever the Location HTTP header received in a redirect response contains a relative URI.

The check performed in HttpRetrievalElement is a bit too restrictive. Not starting with "http" does not necessarily mean the URI is relative (it could be "ftp://foo"). Besides the scheme part of a URI is case-insensitive, and so HTTP://example.com should be considered as a valid absolute URI that should not trigger the warning!
Comment 1 Abel Rionda 2009-04-20 08:41:03 UTC
Used isAbsolute method from Java.net.URI class.
Comment 2 fd 2009-04-30 11:56:38 UTC
While having a look, I realized that we were not entirely consistent throughout the code on the way URIs were resolved.

Resource.parseUri implements some exception-to-the-rules to handle unsafe characters that are generally accepted by browsers. Since it was being used in a few places, I thought it would be better to be consistent and use it everywhere.

DefaultInputModeTest.validInputMode still uses a call to "new URI". It doesn't seem such a good idea to parse the URI with relaxed rules in that case.

Also replaced HTTP_RESPONSE-4 by HTTP_RESPONSE-6 in the case when the URI of the Location HTTP header cannot be parsed. In the absence of a more precise error code, that just sounded less confusing to say: "the URI does not have the http/https scheme" than "there is no Location header" (since there is one).