Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I write something like the following into the navigation bar of Mozilla Firefox, nothing happens:

org-protocol://capture://p/http%3A%2F%2Fsuperuser.com%2Fquestions%2Fask/protocol%20in%20firefox%20does%20not%20take%20%22%252F%22%20as%20part%20of%20a%20string%20-%20Super%20User/

When I leave out all of the %2F, the URL is processed fine. Calling emacsclient through the terminal works including the %2F.

In some previous version of Firefox this protocol worked well for every case. Why does Firefox now recognize the %2F in this case?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I believe this is a security feature. %2F as you may know is the URL-encoding for the forward slash / character. By allowing %2F it is essentially allowing directory traversal that goes "under the radar", i.e. it prevents the user from clearly seeing that they are traversing directories. Combine this with allowing the . character and you can do something nasty, especially if you're talking about the local filesystem where directory traversal isn't carefully restricted as it often (but not always) is by HTTP servers.

Do you remember the specific versions of Firefox where this worked, and the versions where it stopped working? There have been several input validation related security patches in Firefox over the years for various directory traversal exploits. Your URI may be tripping the security code. There are even some complaints in some of the links below that, depending on the specific version, the attempted patches either worsened the problem or caused some false positives; i.e., the code would block legitimate URIs.

  1. http://www.securityfocus.com/bid/24191/references
  2. http://www.securiteam.com/securitynews/5LP011FLPC.html
  3. http://www.securiteam.com/securitynews/5CP0M0UN5A.html
  4. http://www.mozilla.org/security/announce/2011/mfsa2011-16.html
share|improve this answer
    
I am using Ubuntu and I recently upgraded from 10.10 to 12.04 LTS. The problem appeared in Firefox 13 and still exists for 14. –  testphys Jul 20 '12 at 18:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.