9 ms·

Firefox – Fix parsing of content-length http3 header

113 points by frankjr 5y ago

gilrain 5y ago
There is a response from a Mozilla security member at lobste.rs. https://lobste.rs/s/zcjtv2/1749908_infinite_loop_http3_hangs_socket#c_kikbal https://lobste.rs/s/zcjtv2/1749908_infinite_loop_http3_hangs...
- hdjjhhvvhga 5y ago
  This is the interesting bit I had no idea about: > [Q] Do I understand from this that Mozilla can just update my browser settings remotely without my updating‽ > [A] Yes. This is part of the “Remote settings” service, which we can use to ship or unship features (or gradually) or recover from breakage (like here!). We mostly use it as a backend for Firefox Sync and certificate revocation lists. Technically, we could also ship a new Firefox executable and undo / change settings, but that would realistically take many more hours. Needless to says, every “large” software project has these capabilities. This is new to me. Can anyone tell me which other "large" projects have this capability?
  - miohtama 5y ago
    Chrome
  - iqanq 5y ago
    They are busy making us hate them as much as they can, eh?
  - Karunamon 5y ago
    Multiple reports on the initial thread (https://news.ycombinator.com/item?id=29918717 https://news.ycombinator.com/item?id=29918717) that telemetry features are getting silently re-enabled after users explicitly disable them. If you had telemetry on, you hit this bug immediately due to the server configuration. I wonder if this is to blame? In any case, this is incredibly sketchy behavior for a "user-empowering", "privacy focused" browser.
  - pmontra 5y ago
    I didn't know about Remote Settings. I found some detailed information on Mozilla's website [1] and I have three entries about RemoteSettings in about:config. app.normandy.startupRolloutPrefs.browser.topsites.useRemoteSetting browser.topsites.useRemoteSetting browser.urlbar.quicksuggest.remoteSettings.enabled I turned them to false. This [2] explains what Normandy is. [1] https://firefox-source-docs.mozilla.org/services/settings/index.html https://firefox-source-docs.mozilla.org/services/settings/in... [2] https://firefox-source-docs.mozilla.org/toolkit/components/normandy/normandy/index.html#components-normandy https://firefox-source-docs.mozilla.org/toolkit/components/n...
  - djdjfhsje33edh 5y ago
    That's insane. Is there a way to disable "Remote settings" in about:config?
    - Schute 5y ago
      Not tested and I have no idea what this breaks, but you could set services.settings.server to something unusable like localhost. The pref was listed here (https://remote-settings.readthedocs.io/en/latest/tutorial-dev-server.html#prepare-the-client https://remote-settings.readthedocs.io/en/latest/tutorial-de...) in the dev environment instructions.
  - tomudding 5y ago
    > Can anyone tell me which other "large" projects have this capability? I'd say that all popular apps (Android/iOS) have such functionality. Most will probably use it for A/B testing, but technically you could change anything you'd like with it. Apart from the companies creating their own implementations [0], popular services I have seen include Optimizely [1] and Firebase Remote Config [2]. [0]: https://engineering.fb.com/2014/01/09/android/airlock-facebook-s-mobile-a-b-testing-framework/ https://engineering.fb.com/2014/01/09/android/airlock-facebo... [1]: https://www.optimizely.com/products/intelligence/full-stack-experimentation/ https://www.optimizely.com/products/intelligence/full-stack-... [2]: https://firebase.google.com/docs/remote-config/ https://firebase.google.com/docs/remote-config/
  - kevingadd 5y ago
    Most large software that hits servers on the network will have this because it's borderline malpractice not to. Not only would it make it difficult or impossible to fix third-party regressions like this, but if your software started causing issues for third parties (like crashing their servers or getting users kicked off the internet or corrupting their data), you'd have no way to mitigate it in a reasonable amount of time. FWIW I maintained a popular chrome extension (100k weekly users) and I eventually had to add an extensive set of chicken bits pulled from my server multiple times a day. Why? Because chrome updates take over a day to propagate and the extension could regularly break when webdevs made frontend changes to the websites my end users visited. It simply wasn't feasible to ask end users to manually pull a chrome update every time this happened (not to mention that chrome's extension store is designed to make this very hard.) I added an option to disable it but as far as I know none of my users turned that on. Not exactly the same but most modern hardware has equivalent functionality where they can flip 'chicken bits' in the hw to disable various features in response to regressions - stuff like spectre or meltdown is a good example. Naturally that is instead flipped by OS or firmware updates, but considering those come down across the wire automatically now, it's basically the same idea.
    - hdjjhhvvhga 5y ago
      > Not only would it make it difficult or impossible to fix third-party regressions like this, but if your software started causing issues for third parties (like crashing their servers or getting users kicked off the internet or corrupting their data), you'd have no way to mitigate it in a reasonable amount of time. I completely agree that in the current case resetting it remotely is the easiest solution for both parties. However, it is probably the first time many users learned something like this exists. One would think an open browser promoting user empowerment would have more transparency on this feature and how it can be controlled.
    - patrakov 5y ago
      This is also a place where corrupt governments can impose sanctions on other countries through.
      - 5y ago
  - jacquesm 5y ago
    That also explains how the telemetry stuff could have been returned to default even though it was disabled, this mechanism has a lot of bad use cases that you'd have to trust Mozilla to never abuse.
  - tinus_hn 5y ago
    For what it’s worth this sentence was updated.
- mzs 5y ago
  I wonder if remote settings is what changed my proxy settings after update too.
etaty 5y ago
The code looks so much error prone. That's scary! (+1 -1, string constant, boolean parameters) They should introduce some functional programming into this!
frankjr 5y ago
The related bug ticket https://bugzilla.mozilla.org/show_bug.cgi?id=1749957 https://bugzilla.mozilla.org/show_bug.cgi?id=1749957
- edoceo 5y ago
  Oof, treating Content-Length as case sensitive?
andreareina 5y ago
Is this the bug that's causing firefox to hang as of recently? https://news.ycombinator.com/item?id=29918052 https://news.ycombinator.com/item?id=29918052 [edited, link was to this same discussion]
- szszrk 5y ago
  Seems so. It made Firefox crashloop as well.
  - ocdtrekkie 5y ago
    Wow, this sounds like a lot I avoided by having QUIC blocked at the network level.
    - jacquesm 5y ago
      Smart person. I wished I had had that foresight. Would have saved me a couple of hours.
- teddyh 5y ago
  You mean https://news.ycombinator.com/item?id=29918052 https://news.ycombinator.com/item?id=29918052
  - andreareina 5y ago
    Welp, yes thanks. Edited.
- deleted 5y ago
  [deleted]
- robotnikman 5y ago
  Interesting, was wondering why it was doing that recently. Seems when I try to use some extensions it triggers for me
The_rationalist 5y ago
I wonder if mozilla will migrate development to github.com now that phabricator development has been stopped.
- deleted 5y ago
  [deleted]
- dblohm7 5y ago
  (Former Mozilla employee) I would be very surprised if they did. The Firefox development workflow does not map very well onto Github.
  - The_rationalist 5y ago
    care to explain concretely how it does not map?
    - fabrice_d 5y ago
      For one, phabricator is only used for code reviews, not for issue tracking which is managed by bugzilla. Github issues are nowhere near usable for a large product such as gecko/firefox.
      - The_rationalist 5y ago
        note: IIRC Wikimedia had deprecated Bugzilla for bug reporting and replaced it by Phabricator. > Github issues are nowhere near usable for a large product such as gecko/firefox I have huge doubts about that. Looking at the development of Servo on github was beautiful, the colored tags, the PR views, the activity stats, the reviews diffs, the wikis, everything about it was much more readable than it is on Bugzilla/phabricator IMHO. https://github.com/servo/servo https://github.com/servo/servo The same can be said currently about webrender. About scale, github is battletested, for Example Rust is an example of a large scale repo with a LOT of activity (~has more weekly commits than gecko-dev) so the premise Github issues are nowhere near usable for a large product seems false. What idiosyncrasies could mozilla devs have that are immutable and that make them so much different from large projects developped on github? You specifically mention issues: Github can do meta-issues, can auto closes issues after PR merge, has bidirectional PR/issues references, can autoclose issues on markdown checklist check, etc etc and if you couldn't fit into existing github features, I'm pretty sure you could totally solve your issues with Actions such as https://github.com/marketplace/actions/dependent-issues https://github.com/marketplace/actions/dependent-issues Also github is accomodating, when the Apache foundation migrated to github they were open to do changes to the platform to facilitate Apache needs, cf: https://github.blog/2019-04-29-apache-joins-github-community/ https://github.blog/2019-04-29-apache-joins-github-community... In addition to my belief that github can be better or at least as good as buzilla, if gecko migrated to github, it would attract order of magnitudes more open source contributions because of the lower barrier to entry and to familiarity (also bugzilla is awful on smartphones) You really think you should seriously consider the migration.
iqanq 5y ago
>/* aIgnoreCase = */ true Very interesting, is that comment inserted automatically by an IDE?
- matsemann 5y ago
  A nice way to tell what the random bool parameter does, without having to declare a variable with ignoreCase=true first and pass in to self-document. But at least JetBrains IDEs show inline the parameter names, and multiple languages have named parameters, which for booleans at least is a nice thing.
  - nerdponx 5y ago
    This is a great reason why programming languages should support named arguments.
- _moof 5y ago
  This is standard practice in a lot of places because bare Booleans in parameter lists don't communicate anything useful to the reader. Don't know if there are IDEs that automate it though. (In most languages one should avoid designing functions that take Booleans like this in the first place and use a flags/options parameter instead.)
  - nyuszika7h 5y ago
    In Python, you can just specify `foo=bar` when invoking the function, or even better, make `foo` a keyword-only argument.
foxfluff 5y ago
But why does failure to parse http headers cause the browser to busyloop and block all requests?
- secondcoming 5y ago
  Comment 5 here explains it https://bugzilla.mozilla.org/show_bug.cgi?id=1749957 https://bugzilla.mozilla.org/show_bug.cgi?id=1749957
  - muizelaar 5y ago
    Direct link: https://bugzilla.mozilla.org/show_bug.cgi?id=1749957#c5 https://bugzilla.mozilla.org/show_bug.cgi?id=1749957#c5
secondcoming 5y ago
The joys of HTTP and human-readable data formats in general!
- josefx 5y ago
  more like the joys of "robust" APIs where instead of having one valid input and rejecting everything else you have billions of valid inputs and raising an error is considered a bug on your side. Worse of all case insensitivity, not all languages have the same casing rules, so you just ask for bugs that only appear when your user is not US American.
- masklinn 5y ago
  Isn’t this issue in an http/3 component, specifically a non-human-readable format?
  - secondcoming 5y ago
    No, the issue was that the Content-Length header was searched for in a case-sensitive manner
dzogchen 5y ago
Hopefully this will be a wake-up call for Mozilla, to stop with their fruitless rewrite and catch up with Chrome, or die like Netscape did.
- pornel 5y ago
  What a mean and pointless comment. It's just a bug. It's not even a "fruitless rewrite" — this bug is in C++ code. And the implementation of HTTP/3, that was Google QUIC, is required for chasing Chrome's "fire and motion".
  - rossmohax 5y ago
    For Mozilla as a company, as a business, is there a benefit of pouring resources into own web engine?
    - cptskippy 5y ago
      That's the wrong way to think about it. Mozilla isn't a for profit business, they are a non-profit with a mission. The right question is, does pouring resources into their own web page align with their mission statement? https://www.mozilla.org/en-US/mission/ https://www.mozilla.org/en-US/mission/
      - sp332 5y ago
        This is incorrect. The Mozilla Foundation (the non-profit) owns the Mozilla Corporation, which is for-profit and does Firefox development. The Corporation is the one that gets money from Google, and sends millions of dollars per year to the Foundation.
        cptskippy 5y ago
        Is it though? https://blog.mozilla.org/press/2005/08/mozilla-foundation-forms-new-organization-to-further-the-creation-of-free-open-source-internet-software-including-the-award-winning-mozilla-firefox-browser/ https://blog.mozilla.org/press/2005/08/mozilla-foundation-fo... > The Mozilla Corporation is a taxable subsidiary that serves the non-profit, public benefit goals of its parent, the Mozilla Foundation, and the vast Mozilla community. The Mozilla Corporation is a wholly owned subsidiary of the Foundation. The constructs are for regulatory and financial hand waving.
vkatsuba 5y ago
Pretty interesting!
danielmg 5y ago
Reading the bug report: https://bugzilla.mozilla.org/show_bug.cgi?id=1749957#c5 https://bugzilla.mozilla.org/show_bug.cgi?id=1749957#c5 and then the code, isn't there still a problem if content-length is not set by the server? Not that it should ever not be set but... if (contentLengthStart == -1) { // There is no content-Length. return; } That's the same flow it would have taken with the case sensitive code.
- zaarn 5y ago
  I suspect no, because there is no mismatch between there being no content length header found by this file and the content header later being discovered by some other part of the code. It'll probably require more digging but I don't think FF would crash if the header was missing, this was likely caused by the header existing but this part disagreeing about it.
- gmfawcett 5y ago
  > Not that it should ever not be set I am an HTTP/1.1 dinosaur. Is chunked transfer encoding no longer a thing in HTTP/3? It used to be a valid reason to omit Content-Length.
  - masklinn 5y ago
    > Is chunked transfer encoding no longer a thing in HTTP/3? It used to be a valid reason to omit Content-Length. IIRC HTTP/2 and HTTP/3 are essentially always chunked. I would expect a missing content-length to be completely valid.
    - Matthias247 5y ago
      That is correct. By default HTTP/2 and HTTP/3 requests are streamed and can have an "infinite" length. The presence of a content-length header will limit limit that length, and inform the peer upfront on how much data will be sent. For HTTP/1.1, a stream where the length is not known upfront required the usage of chunked encoding. With HTTP/2 and /3 that encoding is no longer required since the underlying protocol already support framing and contains and end-of-stream information.
rossmohax 5y ago
From comments in Bugzilla learned about https://profiler.firefox.com/docs/#/ https://profiler.firefox.com/docs/#/ , looks super cool! C/C++ tooling improved a lot in last decade.
- ognarb 5y ago
  There is a lot of profiling and debugging tools for C/C++, funny enough a lot of them are originated from the KDE community. From the top of my mind: * valgrind (https://valgrind.org/ https://valgrind.org/): Contains a lot of tools * Heaptrack (https://apps.kde.org/heaptrack/ https://apps.kde.org/heaptrack/): For memory allocation analysis * KCachegrind (https://apps.kde.org/kcachegrind/ https://apps.kde.org/kcachegrind/): For call graph vizualisations * ELF Dissector (https://apps.kde.org/elf-dissector/ https://apps.kde.org/elf-dissector/): For analysis of binary files/dependencies * Massif-Visualizer (https://apps.kde.org/massif-visualizer/ https://apps.kde.org/massif-visualizer/): Valgrind massif visualiser * Gammaray (https://www.kdab.com/development-resources/qt-tools/gammaray/ https://www.kdab.com/development-resources/qt-tools/gammaray...): Tool to analysis the current state of a Qt project a bit like you would do with firefox inspector.
  - eitland 5y ago
    > funny enough a lot of them are originated from the KDE community. How is that funny?
    - jraph 5y ago
      Funny is probably a funny way of saying noteworthy here.
  - dralley 5y ago
    FYI, most of these work great on other languages languages. Massif and most of the valgrind suite (cachegrind, callgrind, memcheck) can be used with Rust.
    - ognarb 5y ago

113 points by frankjr 5y ago

There is a response from a Mozilla security member at lobste.rs. https://lobste.rs/s/zcjtv2/1749908_infinite_loop_http3_hangs_socket#c_kikbal https://lobste.rs/s/zcjtv2/1749908_infinite_loop_http3_hangs...

hdjjhhvvhga 5y ago
This is the interesting bit I had no idea about: > [Q] Do I understand from this that Mozilla can just update my browser settings remotely without my updating‽ > [A] Yes. This is part of the “Remote settings” service, which we can use to ship or unship features (or gradually) or recover from breakage (like here!). We mostly use it as a backend for Firefox Sync and certificate revocation lists. Technically, we could also ship a new Firefox executable and undo / change settings, but that would realistically take many more hours. Needless to says, every “large” software project has these capabilities. This is new to me. Can anyone tell me which other "large" projects have this capability?
- miohtama 5y ago
  Chrome
- iqanq 5y ago
  They are busy making us hate them as much as they can, eh?
- Karunamon 5y ago
  Multiple reports on the initial thread (https://news.ycombinator.com/item?id=29918717 https://news.ycombinator.com/item?id=29918717) that telemetry features are getting silently re-enabled after users explicitly disable them. If you had telemetry on, you hit this bug immediately due to the server configuration. I wonder if this is to blame? In any case, this is incredibly sketchy behavior for a "user-empowering", "privacy focused" browser.
- pmontra 5y ago
  I didn't know about Remote Settings. I found some detailed information on Mozilla's website [1] and I have three entries about RemoteSettings in about:config. app.normandy.startupRolloutPrefs.browser.topsites.useRemoteSetting browser.topsites.useRemoteSetting browser.urlbar.quicksuggest.remoteSettings.enabled I turned them to false. This [2] explains what Normandy is. [1] https://firefox-source-docs.mozilla.org/services/settings/index.html https://firefox-source-docs.mozilla.org/services/settings/in... [2] https://firefox-source-docs.mozilla.org/toolkit/components/normandy/normandy/index.html#components-normandy https://firefox-source-docs.mozilla.org/toolkit/components/n...
- djdjfhsje33edh 5y ago
  That's insane. Is there a way to disable "Remote settings" in about:config?
  - Schute 5y ago
    Not tested and I have no idea what this breaks, but you could set services.settings.server to something unusable like localhost. The pref was listed here (https://remote-settings.readthedocs.io/en/latest/tutorial-dev-server.html#prepare-the-client https://remote-settings.readthedocs.io/en/latest/tutorial-de...) in the dev environment instructions.
- tomudding 5y ago
  > Can anyone tell me which other "large" projects have this capability? I'd say that all popular apps (Android/iOS) have such functionality. Most will probably use it for A/B testing, but technically you could change anything you'd like with it. Apart from the companies creating their own implementations [0], popular services I have seen include Optimizely [1] and Firebase Remote Config [2]. [0]: https://engineering.fb.com/2014/01/09/android/airlock-facebook-s-mobile-a-b-testing-framework/ https://engineering.fb.com/2014/01/09/android/airlock-facebo... [1]: https://www.optimizely.com/products/intelligence/full-stack-experimentation/ https://www.optimizely.com/products/intelligence/full-stack-... [2]: https://firebase.google.com/docs/remote-config/ https://firebase.google.com/docs/remote-config/
- kevingadd 5y ago
  Most large software that hits servers on the network will have this because it's borderline malpractice not to. Not only would it make it difficult or impossible to fix third-party regressions like this, but if your software started causing issues for third parties (like crashing their servers or getting users kicked off the internet or corrupting their data), you'd have no way to mitigate it in a reasonable amount of time. FWIW I maintained a popular chrome extension (100k weekly users) and I eventually had to add an extensive set of chicken bits pulled from my server multiple times a day. Why? Because chrome updates take over a day to propagate and the extension could regularly break when webdevs made frontend changes to the websites my end users visited. It simply wasn't feasible to ask end users to manually pull a chrome update every time this happened (not to mention that chrome's extension store is designed to make this very hard.) I added an option to disable it but as far as I know none of my users turned that on. Not exactly the same but most modern hardware has equivalent functionality where they can flip 'chicken bits' in the hw to disable various features in response to regressions - stuff like spectre or meltdown is a good example. Naturally that is instead flipped by OS or firmware updates, but considering those come down across the wire automatically now, it's basically the same idea.
  - hdjjhhvvhga 5y ago
    > Not only would it make it difficult or impossible to fix third-party regressions like this, but if your software started causing issues for third parties (like crashing their servers or getting users kicked off the internet or corrupting their data), you'd have no way to mitigate it in a reasonable amount of time. I completely agree that in the current case resetting it remotely is the easiest solution for both parties. However, it is probably the first time many users learned something like this exists. One would think an open browser promoting user empowerment would have more transparency on this feature and how it can be controlled.
  - patrakov 5y ago
    This is also a place where corrupt governments can impose sanctions on other countries through.
    - 5y ago
- jacquesm 5y ago
  That also explains how the telemetry stuff could have been returned to default even though it was disabled, this mechanism has a lot of bad use cases that you'd have to trust Mozilla to never abuse.
- tinus_hn 5y ago
  For what it’s worth this sentence was updated.
mzs 5y ago
I wonder if remote settings is what changed my proxy settings after update too.

etaty 5y ago

The code looks so much error prone. That's scary! (+1 -1, string constant, boolean parameters) They should introduce some functional programming into this!

frankjr 5y ago

The related bug ticket https://bugzilla.mozilla.org/show_bug.cgi?id=1749957 https://bugzilla.mozilla.org/show_bug.cgi?id=1749957

edoceo 5y ago
Oof, treating Content-Length as case sensitive?

andreareina 5y ago

Is this the bug that's causing firefox to hang as of recently? https://news.ycombinator.com/item?id=29918052 https://news.ycombinator.com/item?id=29918052 [edited, link was to this same discussion]

szszrk 5y ago
Seems so. It made Firefox crashloop as well.
- ocdtrekkie 5y ago
  Wow, this sounds like a lot I avoided by having QUIC blocked at the network level.
  - jacquesm 5y ago
    Smart person. I wished I had had that foresight. Would have saved me a couple of hours.
teddyh 5y ago
You mean https://news.ycombinator.com/item?id=29918052 https://news.ycombinator.com/item?id=29918052
- andreareina 5y ago
  Welp, yes thanks. Edited.
deleted 5y ago
[deleted]
robotnikman 5y ago
Interesting, was wondering why it was doing that recently. Seems when I try to use some extensions it triggers for me

The_rationalist 5y ago

I wonder if mozilla will migrate development to github.com now that phabricator development has been stopped.

deleted 5y ago
[deleted]
dblohm7 5y ago
(Former Mozilla employee) I would be very surprised if they did. The Firefox development workflow does not map very well onto Github.
- The_rationalist 5y ago
  care to explain concretely how it does not map?
  - fabrice_d 5y ago
    For one, phabricator is only used for code reviews, not for issue tracking which is managed by bugzilla. Github issues are nowhere near usable for a large product such as gecko/firefox.
    - The_rationalist 5y ago
      note: IIRC Wikimedia had deprecated Bugzilla for bug reporting and replaced it by Phabricator. > Github issues are nowhere near usable for a large product such as gecko/firefox I have huge doubts about that. Looking at the development of Servo on github was beautiful, the colored tags, the PR views, the activity stats, the reviews diffs, the wikis, everything about it was much more readable than it is on Bugzilla/phabricator IMHO. https://github.com/servo/servo https://github.com/servo/servo The same can be said currently about webrender. About scale, github is battletested, for Example Rust is an example of a large scale repo with a LOT of activity (~has more weekly commits than gecko-dev) so the premise Github issues are nowhere near usable for a large product seems false. What idiosyncrasies could mozilla devs have that are immutable and that make them so much different from large projects developped on github? You specifically mention issues: Github can do meta-issues, can auto closes issues after PR merge, has bidirectional PR/issues references, can autoclose issues on markdown checklist check, etc etc and if you couldn't fit into existing github features, I'm pretty sure you could totally solve your issues with Actions such as https://github.com/marketplace/actions/dependent-issues https://github.com/marketplace/actions/dependent-issues Also github is accomodating, when the Apache foundation migrated to github they were open to do changes to the platform to facilitate Apache needs, cf: https://github.blog/2019-04-29-apache-joins-github-community/ https://github.blog/2019-04-29-apache-joins-github-community... In addition to my belief that github can be better or at least as good as buzilla, if gecko migrated to github, it would attract order of magnitudes more open source contributions because of the lower barrier to entry and to familiarity (also bugzilla is awful on smartphones) You really think you should seriously consider the migration.

iqanq 5y ago

>/* aIgnoreCase = */ true Very interesting, is that comment inserted automatically by an IDE?

matsemann 5y ago
A nice way to tell what the random bool parameter does, without having to declare a variable with ignoreCase=true first and pass in to self-document. But at least JetBrains IDEs show inline the parameter names, and multiple languages have named parameters, which for booleans at least is a nice thing.
- nerdponx 5y ago
  This is a great reason why programming languages should support named arguments.
_moof 5y ago
This is standard practice in a lot of places because bare Booleans in parameter lists don't communicate anything useful to the reader. Don't know if there are IDEs that automate it though. (In most languages one should avoid designing functions that take Booleans like this in the first place and use a flags/options parameter instead.)
- nyuszika7h 5y ago
  In Python, you can just specify `foo=bar` when invoking the function, or even better, make `foo` a keyword-only argument.

foxfluff 5y ago

But why does failure to parse http headers cause the browser to busyloop and block all requests?

secondcoming 5y ago
Comment 5 here explains it https://bugzilla.mozilla.org/show_bug.cgi?id=1749957 https://bugzilla.mozilla.org/show_bug.cgi?id=1749957
- muizelaar 5y ago
  Direct link: https://bugzilla.mozilla.org/show_bug.cgi?id=1749957#c5 https://bugzilla.mozilla.org/show_bug.cgi?id=1749957#c5

secondcoming 5y ago

The joys of HTTP and human-readable data formats in general!

josefx 5y ago
more like the joys of "robust" APIs where instead of having one valid input and rejecting everything else you have billions of valid inputs and raising an error is considered a bug on your side. Worse of all case insensitivity, not all languages have the same casing rules, so you just ask for bugs that only appear when your user is not US American.
masklinn 5y ago
Isn’t this issue in an http/3 component, specifically a non-human-readable format?
- secondcoming 5y ago
  No, the issue was that the Content-Length header was searched for in a case-sensitive manner

dzogchen 5y ago

Hopefully this will be a wake-up call for Mozilla, to stop with their fruitless rewrite and catch up with Chrome, or die like Netscape did.

pornel 5y ago
What a mean and pointless comment. It's just a bug. It's not even a "fruitless rewrite" — this bug is in C++ code. And the implementation of HTTP/3, that was Google QUIC, is required for chasing Chrome's "fire and motion".
- rossmohax 5y ago
  For Mozilla as a company, as a business, is there a benefit of pouring resources into own web engine?
  - cptskippy 5y ago
    That's the wrong way to think about it. Mozilla isn't a for profit business, they are a non-profit with a mission. The right question is, does pouring resources into their own web page align with their mission statement? https://www.mozilla.org/en-US/mission/ https://www.mozilla.org/en-US/mission/
    - sp332 5y ago
      This is incorrect. The Mozilla Foundation (the non-profit) owns the Mozilla Corporation, which is for-profit and does Firefox development. The Corporation is the one that gets money from Google, and sends millions of dollars per year to the Foundation.
      - cptskippy 5y ago
        Is it though? https://blog.mozilla.org/press/2005/08/mozilla-foundation-forms-new-organization-to-further-the-creation-of-free-open-source-internet-software-including-the-award-winning-mozilla-firefox-browser/ https://blog.mozilla.org/press/2005/08/mozilla-foundation-fo... > The Mozilla Corporation is a taxable subsidiary that serves the non-profit, public benefit goals of its parent, the Mozilla Foundation, and the vast Mozilla community. The Mozilla Corporation is a wholly owned subsidiary of the Foundation. The constructs are for regulatory and financial hand waving.

vkatsuba 5y ago

Pretty interesting!

danielmg 5y ago

Reading the bug report: https://bugzilla.mozilla.org/show_bug.cgi?id=1749957#c5 https://bugzilla.mozilla.org/show_bug.cgi?id=1749957#c5 and then the code, isn't there still a problem if content-length is not set by the server? Not that it should ever not be set but... if (contentLengthStart == -1) { // There is no content-Length. return; } That's the same flow it would have taken with the case sensitive code.

zaarn 5y ago
I suspect no, because there is no mismatch between there being no content length header found by this file and the content header later being discovered by some other part of the code. It'll probably require more digging but I don't think FF would crash if the header was missing, this was likely caused by the header existing but this part disagreeing about it.
gmfawcett 5y ago
> Not that it should ever not be set I am an HTTP/1.1 dinosaur. Is chunked transfer encoding no longer a thing in HTTP/3? It used to be a valid reason to omit Content-Length.
- masklinn 5y ago
  > Is chunked transfer encoding no longer a thing in HTTP/3? It used to be a valid reason to omit Content-Length. IIRC HTTP/2 and HTTP/3 are essentially always chunked. I would expect a missing content-length to be completely valid.
  - Matthias247 5y ago
    That is correct. By default HTTP/2 and HTTP/3 requests are streamed and can have an "infinite" length. The presence of a content-length header will limit limit that length, and inform the peer upfront on how much data will be sent. For HTTP/1.1, a stream where the length is not known upfront required the usage of chunked encoding. With HTTP/2 and /3 that encoding is no longer required since the underlying protocol already support framing and contains and end-of-stream information.

rossmohax 5y ago

From comments in Bugzilla learned about https://profiler.firefox.com/docs/#/ https://profiler.firefox.com/docs/#/ , looks super cool! C/C++ tooling improved a lot in last decade.

ognarb 5y ago
There is a lot of profiling and debugging tools for C/C++, funny enough a lot of them are originated from the KDE community. From the top of my mind: * valgrind (https://valgrind.org/ https://valgrind.org/): Contains a lot of tools * Heaptrack (https://apps.kde.org/heaptrack/ https://apps.kde.org/heaptrack/): For memory allocation analysis * KCachegrind (https://apps.kde.org/kcachegrind/ https://apps.kde.org/kcachegrind/): For call graph vizualisations * ELF Dissector (https://apps.kde.org/elf-dissector/ https://apps.kde.org/elf-dissector/): For analysis of binary files/dependencies * Massif-Visualizer (https://apps.kde.org/massif-visualizer/ https://apps.kde.org/massif-visualizer/): Valgrind massif visualiser * Gammaray (https://www.kdab.com/development-resources/qt-tools/gammaray/ https://www.kdab.com/development-resources/qt-tools/gammaray...): Tool to analysis the current state of a Qt project a bit like you would do with firefox inspector.
- eitland 5y ago
  > funny enough a lot of them are originated from the KDE community. How is that funny?
  - jraph 5y ago
    Funny is probably a funny way of saying noteworthy here.
- dralley 5y ago
  FYI, most of these work great on other languages languages. Massif and most of the valgrind suite (cachegrind, callgrind, memcheck) can be used with Rust.
  - ognarb 5y ago