IPv6 URIs in IE7

Browser Security News » IPv6 URIs in IE7

Browser Security News » IPv6 URIs in IE7 — Wed, 21 Feb 2007 00:17:53 GMT

PingBack from http://www.ie7security.net/2007/02/20/ipv6-uris-in-ie7/

* Off Topic Warning *

zuneone — Wed, 21 Feb 2007 01:00:16 GMT

This is completely off topic but it would be very cool if when you switched tabs in IE7 you get a fresh search box.

Often times I am researching several terms and need to go back and forth between tabs and the previous search keywords I was using are gone.

re: IPv6 URIs in IE7

Viktor Krammer — Wed, 21 Feb 2007 16:17:13 GMT

@Dave Risney

Since RFC 4007 leaves it open whether to encode the % delimiter I would have prefered that it is not escaped in URIs to be consistent with the textual form of IPv6 addresses.

>Non-encoded percents are not permitted in URIs

This is not entirely true. In section 2.4.2 of RFC 2396 it is only mandatory to escape the percent sign "when used as data within a URI". In this special case, however, the percent sign is used as a delimiter, not data.

Another thing I noticed recently is that IE7 does not automatically prepend the http scheme when entering an IPv6 address in the address bar. Both "127.0.0.1" and "[::1]" should connect to "http://127.0.0.1/" and "http://[::1]/" respectively.

* Off Topic Warning *

Viktor Krammer — Wed, 21 Feb 2007 16:22:41 GMT

@zuneone

>it would be very cool if when you switched tabs in IE7 you get a fresh search box.

To get a fresh search box for every tab I recommend using a search toolbar like the Quero Toolbar (www.quero.at).

re: IPv6 URIs in IE7

jon — Wed, 21 Feb 2007 16:59:40 GMT

Why does IE7 not show any details of the certificate on:

javascript:alert(window.document.security);

It appears to return: "This type of document does not have a security certificate" regardless of what page you view, anywhere on the 'Net.

Is this feature dead? and just hasn't been cleaned out? Ditto for things like window.screen Why create the object if it never contains any details about the screen size/position?

re: IPv6 URIs in IE7

RubenP — Wed, 21 Feb 2007 20:25:47 GMT

Nope, http://[::1]/ is not working on my box (XP Pro, and yes, I did enable IPv6), whereas http://127.0.0.1/ and http://localhost/ DO work.

re: IPv6 URIs in IE7

Xepol — Wed, 21 Feb 2007 21:06:32 GMT

Ah, IPv6, the standard that wasn't. I wonder what it would actually take to make people actually use this format? Nothing short of a nuclear war I think. To use it, an app MUST be writen against WinSock 2, and that seems very very unlikely.

Maybe if someone put in an effort making IPv6 work with winsock 1.0, maybe it might fly, but I suspect that a lot of programs would still break. How many people out there can confess to using a double word to storing an IPv4 format, because although the standard was written to be flexible, it never actually happened? Ya, I thought so, you could start a hurricane strength wind with all the hands going up...

@zuneone -> I use it exactly opposite of you. I type the search term in on one page and then click to a new tab to do the actual search.

If I need different search terms per page, I use my google search bar.

Personally, I prefer it the way it is, persistant across pages. Unfortunately, I think you have point. Everything else changes per tab including the address bar, so the search toolbar is inconsitent in its behaviour.

re: IPv6 URIs in IE7

zuneone — Wed, 21 Feb 2007 21:16:08 GMT

@Viktor,

that looks really nice, I'll give it a try! Thanks never heard of it before today.

re: IPv6 URIs in IE7

Dave Risney [MSFT] — Wed, 21 Feb 2007 23:00:01 GMT

@Viktor Krammer

RFC 4007 explicitly doesn't address the issue after noting that the '%' conflicts with the URI syntax and that representation in a URI would require something such as percent-encoding the delimiter.

Wrt "Non-encoded percents are not permitted in URIs". The section of RFC 2396 you mention says '... the percent "%" character always has the reserved purpose of being the escape indicator ...' (the corresponding section in RFC 3986 which obsoletes 2396 has similar text) . That is, the percent character alone only appears in a URI as the delimiter of a percent-encoded octet and never as data or anything else. The '%' in an IPv6 address is a delimiter for the textual representation of the IPv6 address but from the URI syntax perspective its still data that needs to be encoded so as not to interfere with the URI syntax. Accordingly in IE7 we only allow percent-encoded percents as the IPv6 scope-id delimiter.

Thanks for your comments!

@RubenP

Sorry its not working for you. Make sure that your HTTP server supports IPv6.

re: IPv6 URIs in IE7

RubenP — Wed, 21 Feb 2007 23:36:03 GMT

@Dave: So you mean IIS doesn't support IPv6?

re: IPv6 URIs in IE7

Aedrin — Wed, 21 Feb 2007 23:44:17 GMT

"Why create the object if it never contains any details about the screen size/position?"

Perhaps it is there for backwards compatability? So certain things don't immediately break. Just don't show anything?

re: IPv6 URIs in IE7

Dave Risney [MSFT] — Thu, 22 Feb 2007 01:05:02 GMT

@RubenP

IIS6 and later support IPv6 but I don't believe earlier versions do. I don't know if any additional configuration is required to get IPv6 support in IIS going. The following page talks about IPv6 in IIS and may be able to help:

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/4c7c6bce-213a-4125-bc36-2202e3b4c8c8.mspx?mfr=true

re: IPv6 URIs in IE7

Viktor Krammer — Thu, 22 Feb 2007 01:25:44 GMT

@Dave Risney

To escape or not to escape?

You are right, the defintion of IPv6address literal in the RFC 3986 standrd is indeed in conflict with the proposed RFC 4007 standard.

RFC 3986 says in section 2.4 >>Because the percent ("%") character serves as the indicator for percent-encoded octets, it must be percent-encoded as "%25" for that octet to be used as data within a URI.<<

Now the question is, is the percent sign of the scope id part of a component, i.e. data, or is it a delimiter, i.e. not data?

I guess this question will not be fully answered until the RFC 4007 or another RFC standard gets more explicit about how the IPv6address literal is syntactically updated.

web design and SEO

kan — Thu, 22 Feb 2007 18:43:10 GMT

I'll give it a try! Thanks never heard of it before today.

re: IPv6 URIs in IE7

diaw — Fri, 23 Feb 2007 13:16:02 GMT

What does it mean when IPv6 is Limited? this is the status of on my dial-up connections.

re: IPv6 URIs in IE7

ralph — Fri, 23 Feb 2007 16:47:32 GMT

Another bug found in IE7 for Vista:

http://crunchysoftware.wordpress.com/2007/02/23/ie7-refreshing-in-xp-but-not-in-vista/

Seems like the refresh doesn't work in IE7 for Vista.

any word on when the Feedback site will be back up? we've got lots of bugs to submit, but nowhere to submit them! :-)

re: IPv6 URIs in IE7

hAl — Fri, 23 Feb 2007 18:42:13 GMT

Another security issues with IE7 ?

http://lcamtuf.coredump.cx/ietrap/

Great for sites that want to keep you lure you on their site and then can keep you there

re: IPv6 URIs in IE7

Steven Roussey — Sat, 24 Feb 2007 02:05:03 GMT

The refreshing bug in Vista is a pain when developing. You got to clear the cache at every try. :( Event the control-F5 trick doesn't work.

Anyhow, here is another bug:

http://www.wayki.com/themes/test.html

What is this error "Internet Explorer cannot open this site... Operation aborted"?? It then erases the page. I added an alert to keep it up for a sec.

Works fine in other browsers, etc...

re: IPv6 URIs in IE7

Nocturnal — Sat, 24 Feb 2007 03:22:39 GMT

Is there a reason why you guys took IE7 off of the critical updates for Microsoft as well as Windows Updates? That was a very stupid move, IMHO! You're leaving many people at risk!

Is there at least a site that explains the move? Why so stealth? Please guys, Eric, anyone???

re: IPv6 URIs in IE7

todd — Sat, 24 Feb 2007 17:19:23 GMT

@Myspace Generator: a.k.a. goose

It's amazing how one line gives away the fact that you know nothing about web browsers.

No one thinks IE7 is the best browser barnone.. not even the IE team! As mentioned many times in blog posts and chats, IE7 was a partial catch up release. Still not caught up to Opera and Firefox, but a million miles better than IE6. (except for all the new bugs)

@MS: still gettting errors trying to access feedback. I seriously doubt that IE7.5 or IE8 will be "caught up", if the bug tracking system is not back on line, and trucking through all the bugs/fixes. You have an army of millions of developers/users that want to help you out, it baffles the mind that you don't see the competitive businees advantage of getting this back online pronto.

re: IPv6 URIs in IE7

harry_richter — Sun, 25 Feb 2007 12:20:15 GMT

@ralph

would be nice, if you could also quote the update on the socalled bug in IE7.

Never mind, I'll do it for you:

"Update 24/02/07: This isn’t actually a Windows problem it’s a Wordpress problem"

There is a general problem here, seen zillions of time throughout the web: software, that is buggy causes problems, and guess who gets the blame: either Windows or Microsoft in general.

It seems to be an exercise in futility, that MS even has the thousands of pages of "best pract" and programming examples, when too many people simply dont care.

Cheers

harry

re: IPv6 URIs in IE7

blogmeme — Sun, 25 Feb 2007 14:51:40 GMT

How do the speeds of IE7 and Firefox compare. Is it possible to configure 'HTTP pipelining' on IE7 as this site suggests you can do in Firefox?

http://firefoxpluginreviews.blogspot.com

re: IPv6 URIs in IE7

anon — Sun, 25 Feb 2007 21:22:40 GMT

@blogmeme, http pipelining is very unstable even in firefox, webpages that use tables alot tend to be rendered incorrectly when they are pipelined.

re: IPv6 URIs in IE7

EricLaw [MSFT] — Tue, 27 Feb 2007 03:20:27 GMT

@blogmeme: No, IE (and some proxies & network hardware) does not support pipelining. You can control the Max Connections Per Server value, though. See "Speed tweaks" here: http://www.enhanceie.com/ie/tweaks.asp

@Steven Roussey: I'm not sure what you mean; CTRL+Refresh still performs an unconditional refresh.

Vis-a-vis the "Operation aborted" issue, please see http://support.microsoft.com/kb/927917/en-us