On Sat, Jul 25, 2026 at 02:13:37PM -0000, Tavis Ormandy wrote:
> I noticed an odd behaviour, maybe it's not intended.
> 
> I was trying to use lynx to read articles in my terminal, but noticed
> google news redirects to a URL containing `:`, which lynx rejects:
> 
> $ lynx -force_html -restrictions=all 
> 'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE
> 5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5'
> Alert!: Illegal redirection URL received from server!
> 
> Okay, but I can see it works without the restrictions, so it must be one
> of the restrictions that `all` is enabling... but which one?
> 
> So I tried with every restriction listed in the man page (except
> options_save, which is listed in the manual but lynx rejects)
> 
> $ lynx -force_html 
> -restrictions=bookmark,bookmark_exec,change_exec_perms,dired_support,disk_save,dotfiles,download,editor,exec,exec_frozen,externals,file_url,goto,inside_ftp,inside_news,inside_rlogin,inside_telnet,jump,multibook,mail,news_post,outside_ftp,outside_news,outside_rlogin,outside_telnet,print,shell,suspend,telnet_port,useragent
>  
> 'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5'

A more complete list can be printed using
        lynx -restrictions ?
 
fwiw, there are a couple not listed in the manpage:

--- expected    2026-07-25 13:47:14.665828027 -0400
+++ actual      2026-07-25 13:47:50.389827687 -0400
@@ -1,6 +1,10 @@
+all
 bookmark
 bookmark_exec
 change_exec_perms
+chdir
+compileopts_info
+default
 dired_support
 disk_save
 dotfiles
@@ -16,9 +20,13 @@
 inside_rlogin
 inside_telnet
 jump
+lynxcfg_info
+lynxcfg_xinfo
+lynxcgi
 mail
 multibook
 news_post
+option_save
 outside_ftp
 outside_news
 outside_rlogin

but adding those (chdir, etc.) doesn't seem to trigger the problem.

> Except that works fine :)
> 
> Maybe I don't understand how it's supposed to work!

the trace option may help.  The first case gives

HTTP: Picked up location 
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en'
HTTP/1.0 302 Found
HTAccess:  status=399
HTAccess: 
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5'
 is a redirection URL.
HTAccess: Redirecting to 
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en'

Alert!: Illegal redirection URL received from server!

User message: Illegal URL: 
https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en

The second one says

HTTP: Picked up location 
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en'
HTTP/1.0 302 Found
HTAccess:  status=399
HTAccess: 
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5'
 is a redirection URL.
HTAccess: Redirecting to 
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en'
User message: Using 
https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en

so... the issue is detected right after the "Redirecting".

Referring to the source code, the "Illegal" message happens in

        src/LYGetFile.c

in a chunk beginning

                if (!HTPermitRedir &&
                    (url_type == LYNXDOWNLOAD_URL_TYPE ||
                     url_type == LYNXEXEC_URL_TYPE ||
                     url_type == LYNXPROG_URL_TYPE ||

The HTPermitRedir variable might be set in

        WWW/Library/Implementation/HTRules.c

and is reset in LYGetFile.c if a redirect was done.

The redirected URL is https, and appears to be triggering this;

                     (no_goto_https &&
                      url_type == HTTPS_URL_TYPE) ||

Revisiting the "?" option for printing the list of restrictions, I see
this in the print_restrictions code:

            /* if "goto" is restricted, don't bother tell about its
             * refinements
             */

The table has this line:

    { "goto",           &no_goto,               CAN_ANONYMOUS_GOTO },

and the flag is compiled-in as "TRUE":

userdefs.h:1760:#define CAN_ANONYMOUS_GOTO              TRUE

Offhand, I don't see a way to have lynx print the whole table
(I suppose in this instance it would help to be able to do that).

-- 
Thomas E. Dickey <[email protected]>
https://invisible-island.net

Attachment: signature.asc
Description: PGP signature

Reply via email to