Don't allow http(s) hosts to redirect to ftp://
Reported by
darkudo...@gmail.com,
Oct 5
|
||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0 Example URL: https://bit.ly/2Pev7qb Steps to reproduce the problem: 1. Click on https://bit.ly/2Pev7qb What is the expected behavior? Safari blocks this and shows attached error message. Only if I then click into the address bar and press enter it loads the ftp page. What went wrong? We see ftp://terrax.net/index.html Did this work before? N/A Chrome version: 71.0.3569.0 Channel: dev OS Version: Debian Testing Flash Version: This is a spin-off for https://bugs.chromium.org/p/chromium/issues/detail?id=892610#c2. I also filed a bug at https://bugzilla.mozilla.org/show_bug.cgi?id=1496725.
,
Oct 8
,
Oct 9
Tried testing the issue on reported chrome version #71.0.3569.0 and latest chrome #71.0.3573.0 using Ubuntu 17.10 by following below steps. Steps: ===== 1.Launched chrome. 2.Navigated to "https://bit.ly/2Pev7qb". 3.Observed that the site cannot be reached. Attached screenshot for reference. @reporter: Could you please review the attached screenshot and let us if anything is being missed. If possible request you to provide screencast/screenshot of the issue so that it would help in triaging it further and also confirm if this is specific to Debian. Thanks.!
,
Oct 9
This is a "feature" request to adopt Safari's behavior (better security UX). It's not a regression. I don't see a DNS or network problem on our side. Here is another example: https://bit.ly/2yoJVLp redirects to ftp://ftp.de.debian.org/debian/
,
Oct 9
Thank you for providing more feedback. Adding the requester to the cc list. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Nov 5
As per comment#4 the issue seems to be a feature request, hence marking it as untriaged and requesting someone from the dev team to look into the issue. Thanks.!
,
Nov 13
,
Nov 13
marking available, cc'ing meacer. seems like a low priority thing that would be reasonable to do
,
Nov 13
+palmer and nasko who might have opinions about ftp :) I believe the original report means redirects only, and not navigations. If so, this might be a reasonable thing to do.
,
Nov 13
,
Nov 26
[mkwst]: FYI, since you've been leading the charge on removing some cases where FTP is supported. |
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 by krajshree@chromium.org
, Oct 7