Can Rails / Mongrel accept a form POST with a text field whos value is a URL

Question

In my Rails app I am attempting to create a form that allows users to create a bookmark.

<% form_tag( contents_path ) do %>
  <input name='item_type' value="Bookmark" type="hidden" /></p>
  <h3>Create New Bookmark</h3>
  <p>Title:<input name='item[title]' type="text" /></p>
  <p>URL:<input name='item[url]' type="text" /></p>
  <%= submit_tag 'Create' %>
<% end %>

---

Edit: For clarity, here is the actual html generated by the above template:

<form action="/contents" method="post"><div style="margin:0;padding:0"><input name="authenticity_token" type="hidden" value="cc709c404365f1a5754a7bf0c3fe79ce9ec9f96b" /></div>
  <input name='item_type' value="Bookmark" type="hidden" /></p>
  <h3>Create New Bookmark</h3>
  <p>Title:<input name='item[title]' type="text" /></p>
  <p>URL:<input name='item[url]' type="text" /></p>
  <input name="commit" type="submit" value="Create" />
</form>

As you can see it's a perfectly normal form.

---

It works great unless an actual URL is entered, in which case the server never responds and I get a message in my mongrel.log file

Error reading HTTP body: #<RuntimeError: Socket read return nil>
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel/http_request.rb:105:in `read_socket'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel/http_request.rb:77:in `read_body'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel/http_request.rb:55:in `initialize'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel.rb:149:in `new'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel.rb:149:in `process_client'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel.rb:285:in `run'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel.rb:285:in `initialize'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel.rb:285:in `new'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel.rb:285:in `run'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel.rb:268:in `initialize'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel.rb:268:in `new'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel.rb:268:in `run'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel/configurator.rb:282:in `run'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel/configurator.rb:281:in `each'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel/configurator.rb:281:in `run'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/mongrel_rails:128:in `run'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/../lib/mongrel/command.rb:212:in `run'
/usr/lib/ruby/gems/1.8/gems/mongrel-1.1.4/bin/mongrel_rails:281
/usr/bin/mongrel_rails:16:in `load'
/usr/bin/mongrel_rails:16

As can be seen the request never reaches my controller code.

I have since discovered that submitting any form where a field value starts with the string "http:/" causes the problem. putting any other characters or white-space before it cures the problem. I have also tried this in other Rails apps (on the same server) with the same result.

So it is possible to work around the problem by inserting extra space at the beginning of the string and stripping it on the server.

But I would prefer a server side only fix if one is possible.

I'm hoping that it is just a simple misconfiguration on the server.

I'm running under Rails 2.1.0 on a CPanel based shared hosting arrangement.

Answer 1

The stack trace shows it hasn't loaded any of the Rails code when it falls over, so it's probably not a problem with your code or Rails itself. My guess is that your host is using something like mod_security that thinks your request looks suspicious and is mangling the data on you.

I've had no problems with having URLs entered through forms both through Mongrel and Passenger on Apache, though that's been on a self-managed dedicated server.

Answer 2

why not a form_for instead of form_tag? I just worked through something similar to this and never had an issue posting full urls.

One problem I have is you're showing us the submission form but none of the controller code that's more than likely where the break is.