Skip to content

Fix: Referer and HEAD using WWW::Mechanize (GH#150)#426

Open
oalders wants to merge 1 commit into
masterfrom
fix-150
Open

Fix: Referer and HEAD using WWW::Mechanize (GH#150)#426
oalders wants to merge 1 commit into
masterfrom
fix-150

Conversation

@oalders

@oalders oalders commented Jun 13, 2026

Copy link
Copy Markdown
Member

Closes #150

Problem

A $mech->head($url) request leaked its URL as the Referer header on subsequent get() requests, even after calling back().

_update_page() set $self->{last_uri} for every successful response, and last_uri is the sole source of the Referer header in _modify_request(). Because a HEAD request does not push the page stack, a following back() had nothing to pop, so the HEAD URL persisted as last_uri and leaked as the Referer of the next request.

Changes

  • lib/WWW/Mechanize.pm: gate the last_uri update in _update_page() on the request being GET or POST — the same condition request() uses to decide whether to push the page stack. Non-navigational requests (HEAD/PUT/DELETE) no longer affect the Referer sent on subsequent requests.
  • t/local/referer.t: add coverage that a HEAD does not clobber the Referer of the next request, including the back() case called out in the issue. Converted the fixed tests => N plan to done_testing.
  • t/local/referer-server: raise the connection ceiling to cover the new requests, with an explanatory comment.
  • Changes: note the fix.

Testing

  • New regression tests fail without the fix and pass with it (red-green verified).
  • Full t/local/ suite passes (322 tests).
  • Edited .pm/.t files pass perltidy --assert-tidy.

🤖 Generated with Claude Code

_update_page() set $self->{last_uri} for every successful response,
and last_uri is the sole source of the Referer header in
_modify_request(). Because a HEAD request does not push the page
stack, a following back() had nothing to pop, so the HEAD URL
persisted as last_uri and leaked as the Referer of the next get().

Gate the last_uri update on the request being GET or POST, the same
condition request() uses to decide whether to push the page stack.
Non-navigational requests (HEAD/PUT/DELETE) no longer affect the
Referer sent on subsequent requests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@codecov

codecov Bot commented Jun 13, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.81%. Comparing base (93c8115) to head (088f163).

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #426      +/-   ##
==========================================
+ Coverage   89.80%   89.81%   +0.01%     
==========================================
  Files           3        3              
  Lines         853      854       +1     
  Branches      225      226       +1     
==========================================
+ Hits          766      767       +1     
  Misses         37       37              
  Partials       50       50              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@oalders oalders marked this pull request as ready for review June 13, 2026 09:30
@oalders oalders requested a review from petdance June 13, 2026 09:31
@oalders

oalders commented Jun 13, 2026

Copy link
Copy Markdown
Member Author

@petdance I saw you had linked a branch for a similar fix, but it didn't appear to have any new commits in it. Does this fix seem reasonable?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Referer and HEAD using WWW::Mechanize

1 participant