Trident User agent /null and html in urls

trident user agent errors, /null and html in url path

[adamspa]

Looking through the log files recently on Windows server 2003 and noticed some strange 404 errors:

/shop/prodc></td>++++++++++++<td+align=
/(null)
/shop/(null)

User Agent always has Trident/4.0

Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+GTB6;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)

It appears to be caused by IE8, what needs to be done to have these 404's not happen?

[wilderness]

There's an old thread [webmasterworld.com] on this

[adamspa]

Thanks I did see the older post regarding the (null) 404's, but it is too old to reply to, and other than the obvious "It's MSIE8" I don't see any solutions.
And I haven't seen anything regarding IE8 putting html into the 404'd urls. Maybe it's nothing to worry about.

[dstiles]

One of my sites had a similar error a while back. The customer added a link in a page that wasn't properly closed.

In this specific case the closing quote for the link didn't appear until an opening quote enclosing a css class was found. Yours looks similar?

It may not be a link on your page: it could be one on someone else's site.

[jdMorgan]

It looks like the "(null)" problem described in the other thread, plus exactly the missing-closing-quote problem dstiles describes.

I fix the latter by testing requested URL-paths for "typo-induced" errors, truncating the URL-path at the first 'invalid' character, and if that results in a URL-path that will resolve to an existing file or directory, I 301-redirect to it.

I look for URLs-paths that appear to be valid but have periods, commas, colons, semi-colons, hyphens, single or double-quotes, or the "<" and ">" opening or closing HTML tag characters following them, and just chop those characters off, as they are likely due to errors in forum auto-linking scripts or in HTML source links.

However, before I do that, I also 403 any requests for paths containing "(null)", because I don't know what they are, and don't have time to fool with them... :)

Jim

[Pfui]

OP/adamspa: The UA you indicated, plus the error, do not resemble the /(null) hits I've posted about.* But that's a fake UA so it's a guess as to whether or not the error was a simple code-choke or something unsavory. If the former? Not to fret (unless your code is screwy:) If the latter, I'd say keep your eyes peeled and start 403'ing fake UAs and the Hosts/IPs that run them.

-----
*Here's another of my posts on this topic (...I've been beating this drum for a _long_ time now. Thank you, Jim, for bearing with me:)

Best way to block URIs for "/(null)"?
[webmasterworld.com...]

FWIW: I see between 50 and 100 /(null) hits a month now, all 403'd. Many months ago, one real person touched base but he had no clue. So this remains an Unsolved Mystery but fortunately, the /(null) hits are more single-hit, minor annoyances than not. Well, except when they're like this:

[06/Sep/2009:12:23:00 -0700] "GET /dir01/(null) HTTP/1.1"
[06/Sep/2009:12:23:00 -0700] "GET /dir01/(null) HTTP/1.1"
[06/Sep/2009:12:23:01 -0700] "GET /dir01/(null) HTTP/1.1"
[06/Sep/2009:12:23:01 -0700] "GET /dir01/(null) HTTP/1.1"
[06/Sep/2009:12:23:01 -0700] "GET /dir01/(null) HTTP/1.1"
[06/Sep/2009:12:23:01 -0700] "GET /dir02/(null) HTTP/1.1"
[06/Sep/2009:12:23:03 -0700] "GET /dir01/(null) HTTP/1.1"
[06/Sep/2009:12:23:03 -0700] "GET /(null) HTTP/1.1"

Courtesy of a qwest.com account using -- wait for it -- Trident:

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6; .NET CLR 2.0.50727)

(sighs)

[jdMorgan]

I guess I should point out again (not that it makes a big difference, but for the sake of clarity) that Trident is simply the rendering engine for MSIE 8, in exactly the same way that Gecko is the rendering engine for Mozilla-based browsers such as Firefox and Seamonkey.

So the presence of "Trident" in the UA string is not in any way more-specifically identifying than "MSIE 8.0".

Jim

[Pfui]

Yep, yep. Sorry. "Trident" is just my lazy/shorthand saying that both, and only, "MSIE 8.0" and "Trident/4.0" are always seen in my /(null) hits. Plus other variations are kind of confusing (to this Mac person, granted), when it comes to deciphering what MSN says about which version of MSIE is involved, with/without Trident, and/or when --

MSDN Blogs: The Windows Internet Explorer Weblog/IEBlog:
The Internet Explorer 8 User-Agent String (Updated Edition):
The Trident/4.0 User-Agent String [blogs.msdn.com] (January, 2009)

(Yeesh)

[adamspa]

Thanks for all the info guys. I'm looking further into it, Pfui, looks like you have been dealing with this since IE8 was in Beta... I have also run accross the UA of:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; InfoPath.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSN Optimized;US; AskTB5.3)
Which suggests that some versions of IE7 also use the Trident rendering engine? Or could be compatibility mode in IE8? Weird.
Thanks.

[jdMorgan]

No, read the info at the link Pfui provided above: "MSIE 7.0; ... Trident/4.0;" is the UA for MSIE 8 in "compatibility view" mode. You might also want to check your site thoroughly to see why/if users might find compatibility view mode to be needed when viewing it...

Jim

[adamspa]

I honestly don't think people/users know anything about compatibility mode other than someone told them they should use it. I'm thinking of letting users know that all websites look better and load faster if they use chrome, safari, or firefox. IE is getting worse and worse with every "new and better" version they put out.

[jdMorgan]

Yeah, but if we want to "sell" or "inform" on the Web, we've got to deal with the Web-world as it is, and not as we would wish it to be... Don't waste too much energy worrying about MS -- or even Google for that matter. They are big, huge companies, and will do as they please.

However, a little alternate-browser evangelism never hurt anybody, so long as your site doesn't shove it in the user's face... :)

Watch out for Chrome, though, until it's matured a little. I read yesterday that it saves your login credentials for Web sites as plain-text. The author said, "If your computer is stolen or compromised, all of your saved accounts are toast if the thief has a clue" -- or some-such. I'll take Firefox and Opera for now...

Jim

[dstiles]

Also yesterday, from a zdnet security blog:

"The Google Chrome Frame, which is presented as a seamless way to bring Google Chrome’s open web technologies and speedy JavaScript engine to Internet Explorer, has increased the attack surface for IE users, Microsoft said today."

Oh, goody! Just what we need, yet more holes in MSIE. :)

[Pfui]

After about a year of /(null)-spotting and log-grepping, I thought I finally spied a non-Trident UA last week. Hey!

adsl-71-194-nn.jax.bellsouth.net
Mozilla/5.0 (Linux; U; Android 1.5; en-us; Archos5 Build/CUPCAKE) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1

But nay.

Turned out Google's 'client' category for that build was --

http://www.google.com/m?hl=en&gl=us&client=ms-null&source=android-launcher-widget&q=keyword

Oh, well.