Web Bug Track - A Brief Update

The status quo

Well, here we are 1 year later! It was a year ago we first welcomed you to this "bug blog". It started as just a simple concept... a way to track web bugs in HTML, JavaScript, DOM, CSS, etc. in the world wide web of Web Browsers.

The landscape has changed significantly since starting this blog. Mozilla released Firefox 3, a worthy successor to the hugely popular Firefox 2, even setting a Guinness World Record in the process. Opera released the latest update to their browser, squashing a several pesky bugs and improving their Web Standards by drifting away from legacy IE-spoofing and being the first to pass the ACID3 test! The KDE folks released Konqueror 4.0, boosting speed and cleaning up rendering issues they had. Safari has been making leaps and bounds with WebKit in terms of supporting advanced CSS3 properties and being the second browser to pass the ACID3 test. Finally Microsoft re-opened their bug tracking tool "IE Feedback" on the Connect site when IE8 Beta 1 was released to developers. This was a welcome change as there was much frustration when Microsoft decided to close it (and remove all entries) after IE7 went RTM. We hope that it will remain open when IE8 goes RTM later this year, however if it doesn't you can rest assured that Web Bug Track isn't going anywhere!.

Alas when we began this blog, there was a simple concept we wanted to fulfill. Allow Web Developers and Designers a source to track bugs (regardless of which Browser / Vendor they were for), provide clear workarounds where known to get around bugs and lastly allow the community an opportunity to share their bug findings, so that we can all benefit.

So here we are now getting 1,000s upon 1,000s of hits every month from Developers looking for workarounds, or just looking to find out which versions of a browser are affected by a bug, or which HTML elements have issues in which browser. I can tell you that from the stats and the praise I've received thus far, I feel overwhelmingly satisfied that this experiment has been a huge success... and obviously filled a need in the "Developers Toolbox" of tips and tricks.

---

So where to now?

Good question! There's a few changes coming up that I think will make things that much better.

• Recent Updates Section


• Knol Reference Page - Web Browser Bugs

The Recent Updates Section will allow returning visitors to easily spot changes to bugs / workarounds. An addition to Google's Knol Reference Pages allows direct linking/searching of bugs here on Web Bug Track by Browser, HTML Element Type, JavaScript Method or Property. There will be a few more additions too, but I'll keep those as a surprise for now. ;-)

Thanks for making Web Bug Track a success! I hope you've enjoyed reading it as much as I've enjoyed putting it all together.

Cheers!

Bug/Site Feedback |
Submit a bug

bug 114 - border dashing and rounding not an option in Firefox

Issue: #114
Affects: Firefox 2.x
Fixed in: Firefox 3 (Beta 3 & Final)

Rounded corners make simple boxes look so much more appealing on the Web. CSS3 defines the border-radius CSS property, but of course Firefox, Safari and others implemented their own versions long ago before CSS3 was finalized.

In Firefox, specifying "-moz-border-radius: 5px;" for a block element will give a nice gentle curved corner to any box.

However, if your border is more than 1 (one) pixel in width, and you have it set to dashed, or dotted (e.g. not solid), then Firefox will not show the dashed/dotted pattern, but instead show a solid line.

The good news is that Firefox 3 (currently in Beta) appears to have fixed this issue.

Example:

<style type="text/css">
  div.fancy {
    border: 2px dashed #000066;
    -moz-border-radius: 5px;
  }
</style>
<div class="fancy">
This box should have a:<br/> dark blue<br/> 2 pixel<br/> dashed border<br/> with 5 pixel radius<br/> rounded corners.
</div>

This box should have a:
dark blue
2 pixel
dashed border
with 5 pixel radius
rounded corners.

Known Workarounds: None.

Related Issues: None.

Bug/Site Feedback |
Submit a bug

bug 169 - browsers parse 10 digit numbers as IP addresses

Issue: #169
Affects: IE6, IE7, Firefox
Status: [By Design]

At first this appears to be a "feature", but when the consequences of this bug are thought through, it is just one more vector of attack for unwitting surfers to fall prey to.

If you click on the following link (the href is the same as the text you see), it will take you to a web site!

http://1208929639/

Looks familiar?

The trick is, an "evil" site will look just the same:
http://3493960174/

First off, what are these urls? Well, if you take the IPv4 address of any domain, and convert each octet to hex, concatenate the hex value, then convert back to decimal, you'll get a 10 digit number.

As it turns out, IE & Firefox will handle this 10 digit number, resolve the IP Address, and navigate to it.

e.g. This blog post can be accessed by this URL (only in IE!)
bug 169 - browsers parses 10 digit decimal numbers as IP addresses


What this means, is that phishing scams, and any site that wants to lure you into downloading malicious software, now has yet another way to do so. It also means that any spam filtering software, or blacklisting software needs to handle roughly double the ammount of URLs in order to protect users!

(currently running tests on various browsers to determine the number affected)

Example:

  //tracert www.youtube.com
  // => 208.65.153.238
  // => Hex
  // D0.41.99.EE
  // D04199EE => Decimal
  // => 3493960174
  //<a href="http://3493960174/watch?v=qItugh-fFgg">Fake Label</a>

Try it here:
Best game ever!

Known Workarounds:
No workaround required. This feature is by design and does not realistically increase the attack surface.

Related Issues: None.

bug 317 - onload doesn't work everywhere

Issue: #317
Affects: Firefox, IE6, IE7, Opera, Safari

According to the JavaScript documentation, the onload event can be handled for the body, iframe, img, frameset & object tags. However not all browsers obey this the same.

Supports iframe onload:
Firefox - Yes
IE6, IE7 - Yes
Opera - Yes
Safari - No

Supports object onload:
Firefox - No
IE6, IE7 - No
Opera - No
Safari - Yes

So, take this into consideration if you are planning to use object versus an iframe in your next project.

Known Workarounds: None.

Related Issues: None.

Modern Browsers

Modern Browsers: I expect this to be a moving target, but as of mid-2007 I would only qualify the following as "Modern Browsers". You should expect to see little support, and very few features for browsers not listed here. If your Web Browser is not listed here, it IS time to upgrade.

• Mozilla
  
  
  
  • Mozilla
  
  
  • Firefox 1.5* | 2.0 | 3.0 | 3.5
  
  
  • Camino 1.5
  
  
  • Epiphany 2.2
  
  
  
  


• Opera 8.0 | 9.0 | 9.5


• Safari 3.0 | 3.1 | (4.0*)(Mac or Windows)


• Konqueror 3.5 | 4.0


• Google Chrome 1.0 | 2.0 (based on WebKit)


• Netscape 7.0 | 8.0 | 9.0


• AT&T's Pogo (based on Firefox) [in Limited Beta]


• Internet Explorer 7.0 | 8.0 | 9.0***

***IE9 announced at PDC and on the IE Blog

*Safari 4.0 is now out in Beta for Mac and Windows

*Firefox 1.5 is a modern web browser for sure, but with the fast pace of Firefox development, full support for this version has already moved on. If you are using Firefox 1.5 we strongly suggest you upgrade to Firefox 2.x or, if 3.x when it is available.