On Sat, Jul 25, 2026 at 02:13:37PM -0000, Tavis Ormandy wrote: > I noticed an odd behaviour, maybe it's not intended. > > I was trying to use lynx to read articles in my terminal, but noticed > google news redirects to a URL containing `:`, which lynx rejects: > > $ lynx -force_html -restrictions=all > 'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE > 5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5' > Alert!: Illegal redirection URL received from server! > > Okay, but I can see it works without the restrictions, so it must be one > of the restrictions that `all` is enabling... but which one? > > So I tried with every restriction listed in the man page (except > options_save, which is listed in the manual but lynx rejects) > > $ lynx -force_html > -restrictions=bookmark,bookmark_exec,change_exec_perms,dired_support,disk_save,dotfiles,download,editor,exec,exec_frozen,externals,file_url,goto,inside_ftp,inside_news,inside_rlogin,inside_telnet,jump,multibook,mail,news_post,outside_ftp,outside_news,outside_rlogin,outside_telnet,print,shell,suspend,telnet_port,useragent > > 'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5'
A more complete list can be printed using
lynx -restrictions ?
fwiw, there are a couple not listed in the manpage:
--- expected 2026-07-25 13:47:14.665828027 -0400
+++ actual 2026-07-25 13:47:50.389827687 -0400
@@ -1,6 +1,10 @@
+all
bookmark
bookmark_exec
change_exec_perms
+chdir
+compileopts_info
+default
dired_support
disk_save
dotfiles
@@ -16,9 +20,13 @@
inside_rlogin
inside_telnet
jump
+lynxcfg_info
+lynxcfg_xinfo
+lynxcgi
mail
multibook
news_post
+option_save
outside_ftp
outside_news
outside_rlogin
but adding those (chdir, etc.) doesn't seem to trigger the problem.
> Except that works fine :)
>
> Maybe I don't understand how it's supposed to work!
the trace option may help. The first case gives
HTTP: Picked up location
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en'
HTTP/1.0 302 Found
HTAccess: status=399
HTAccess:
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5'
is a redirection URL.
HTAccess: Redirecting to
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en'
Alert!: Illegal redirection URL received from server!
User message: Illegal URL:
https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en
The second one says
HTTP: Picked up location
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en'
HTTP/1.0 302 Found
HTAccess: status=399
HTAccess:
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5'
is a redirection URL.
HTAccess: Redirecting to
'https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en'
User message: Using
https://news.google.com/rss/articles/CBMiVEFVX3lxTE9OVnBXanNudE5pMzFuT00tdC1ERGhJMXBmN2phb1BiMmJjbnBaWlFYaWN2aFBna1R3Wkd1WnRFdGxMQk0yUTBubGh6bUQ0YW5HVHJJSQ?oc=5&hl=en-US&gl=US&ceid=US:en
so... the issue is detected right after the "Redirecting".
Referring to the source code, the "Illegal" message happens in
src/LYGetFile.c
in a chunk beginning
if (!HTPermitRedir &&
(url_type == LYNXDOWNLOAD_URL_TYPE ||
url_type == LYNXEXEC_URL_TYPE ||
url_type == LYNXPROG_URL_TYPE ||
The HTPermitRedir variable might be set in
WWW/Library/Implementation/HTRules.c
and is reset in LYGetFile.c if a redirect was done.
The redirected URL is https, and appears to be triggering this;
(no_goto_https &&
url_type == HTTPS_URL_TYPE) ||
Revisiting the "?" option for printing the list of restrictions, I see
this in the print_restrictions code:
/* if "goto" is restricted, don't bother tell about its
* refinements
*/
The table has this line:
{ "goto", &no_goto, CAN_ANONYMOUS_GOTO },
and the flag is compiled-in as "TRUE":
userdefs.h:1760:#define CAN_ANONYMOUS_GOTO TRUE
Offhand, I don't see a way to have lynx print the whole table
(I suppose in this instance it would help to be able to do that).
--
Thomas E. Dickey <[email protected]>
https://invisible-island.net
signature.asc
Description: PGP signature
