Jump to content

Erroneous slash inserted between <host> and :<port> in parsed URLs


Recommended Posts

I have seen this problem several times now: I report spam which contains URLs that go to non-standard ports, like port 81, which are written in the email source as one would expect: http://host:81/something. But when SpamCop shows me the URLs it pulled out of the source, it displays the URL as http://host/:81/something which is not the same thing. (It put a slash between the <host> and the :<port> part which shouldn't be there.)

Here's one such situation:

http://www.spamcop.net/mcgi?slice=reportid...ion=showhistory

I couldn't determine if this was a known problem or not so I thought I'd better report it here.

Link to comment
Share on other sites

... http://www.spamcop.net/mcgi?slice=reportid...ion=showhistory

I couldn't determine if this was a known problem or not so I thought I'd better report it here.

Thanks - your link doesn't work for me, I can get to a report by working around the report ID in the link but this does nor show the "full message". Really you need to give us a tracking URL - also URL from report ID
Link to comment
Share on other sites

Thanks - your link doesn't work for me, I can get to a report by working around the report ID in the link but this does nor show the "full message". Really you need to give us a tracking URL - also URL from report ID

Thanks for the quick response and the pointers to those links. Here's the tracking URL:

http://www.spamcop.net/sc?id=z970608035zaa...c818f6beeda6e0z

Link to comment
Share on other sites

I have seen this problem several times now: I report spam which contains URLs that go to non-standard ports, like port 81, which are written in the email source as one would expect: http://host:81/something. But when SpamCop shows me the URLs it pulled out of the source, it displays the URL as http://host/:81/something which is not the same thing. (It put a slash between the <host> and the :<port> part which shouldn't be there.)

<snip>

I couldn't determine if this was a known problem or not so I thought I'd better report it here.

Thanks for the quick response and the pointers to those links. Here's the tracking URL:

http://www.spamcop.net/sc?id=z970608035zaa...c818f6beeda6e0z

...Thanks for providing the tracking URL. :) <g>

...It might be a bit confusing but at least the SpamCop parser seems to have identified the source and offered to report it. IMHO, not a serious problem. It would be interesting to know from TPTB if it's intentional or not but my inclination is to not bother them with something this minor....

Link to comment
Share on other sites

From: "WazoO"

To: "SpamCop, Argyle"

Cc: "SpamCop, Deputies"

Subject: URL decoding & report issue

Date: Mon, 12 Jun 2006 17:00:08 -0500

http://forum.spamcop.net/forums/index.php?showtopic=6513

references Tracking URL of

http://www.spamcop.net/sc?id=z970608035zaa...c818f6beeda6e0z

At issue, a spamvertised URL of

href=3D"http://69-11-1-251.yktn.hsdb.sasknet.sk.ca:81/paypal/index.php?Mfc=

ISAPICommand=3DSignInFPP">https://www.paypal.com/cgi-bin/webscr?cmd=3D_log=

in-run</a>

Parser does the correct thing, isolates the URL, IP address, target

recipient ... however, then tosses up a display that "changed" the

port assignment from ":81" to "/:81" .... for the parsing results, not

a big issue. However, I re-ran a parse and did a "Preview" on the

outgoing reports .... this "changed" version is also included in the

spamvertised URL report .. possibly leading to a bit of confusion

to the receiving abuse desk ....

Specifically, the reported URL is showing in the outgoing report as;

Subject: [spamCop

(http://69-11-1-251.yktn.hsdb.sasknet.sk.ca/:81/paypal/index.php?mfcisapicom

mand=signinfpp) id:preview][spam] Notification of Security Measures

Spamvertised web site:

http://69-11-1-251.yktn.hsdb.sasknet.sk.ca...mmand=signinfpp

http://www.spamcop.net/w3m?i=zpreviewz14ad...d4f3d0b8555992z

http://69-11-1-251.yktn.hsdb.sasknet.sk.ca...mmand=signinfpp

is 69.11.1.251; Mon, 12 Jun 2006 21:47:10 GMT

Yes, agreed that the entire spam is included, but ......

Link to comment
Share on other sites

Date: Tue, 13 Jun 2006 09:24:28 -0400

From: SpamCop/Ellen

To: WazoO

CC: "SpamCop, Argyle"

Subject: Re: URL decoding & report issue

Thanks -- I will bring this to the attention of engineering

Ellen

SpamCop

And by extension, thanks to ryandesign for bringing it up, pointing it out ....

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...