location.href return strange URL

Question

I'm using location.href to get the full URL exists in browser address bar.
To provide more detail, it's important to note that our service has a js file that will be included in our customers sites. So this JS file will generate the full URL of applicant.

I thought this URL is somehow previous URL that redirected to real domain, but how I should prevent this action?

The line of JS code that will generate a link for iframe's src attribute is:

'http://sd.domain.ir/index.php?r=' + Math.floor(Math.random() * (100000000 - 0 + 1)) + 0 + '&ref=' + ((window.btoa) ? btoa(location.href) : 'ie') + '&responsive=' + ((document.querySelector('meta[name="viewport"][content*="width=device-width"]')) ? 'yes' : 'no') + '&params='

Examples of applicant UA:
Mozilla\/5.0 (Linux; U; Android 4.3; en-us; HUAWEI G620-L72 Build\/HuaweiG620-L72) AppleWebKit\/534.24 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/534.24 T5\/2.0 bdbrowser\/6.1.0.4

Mozilla\/5.0 (Linux; U; Android 4.4.3; en-ae; HTC_One Build\/KTU84L) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/534.30

Mozilla\/5.0 (Linux; U; Android 4.3; en-us; GT-I9300 Build\/JSS15J) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/534.30

...

sometimes strange url generated by location.href and I don't know what is the reason. For example:

Main URL is something like below: http://saten.ir/tag/%D8%A8%DB%8C%D9%88%DA%AF%D8%B1%D8%A7%D9%81%DB%8C-%D8%A7%D9%85%DB%8C%D8%B1%D8%B9%D8%A8%D8%A7%D8%B3-%D9%81%D8%AE%D8%B1%D8%A2%D9%88%D8%B1/

But the URL returned by location.href is as below:
http://www.google.com/search?site=&source=hp&ei=mpkeWIvHKYWbsgGtxaSQBg&q=%D8%A7%D9%85%D9%8A%D8%B1%D8%B9%D8%A8%D8%A7%D8%B3+%D9%81%D8%AE%D8%B1%D8%A7%D9%88%D8%B1&oq=%D8%A7%D9%85%D9%8A%D8%B1%D8%B9%D8%A8%D8%A7%D8%B3+%D9%81%D8%AE%D8%B1%D8%A7%D9%88%D8%B1&gs_l=mobile-gws-hp.3...4752.15339.0.16567.0.0.0.0.0.0.0.0..0.0....0...1c.1.64.mobile-gws-hp..0.0.0.UFWL1tf4KDM#scso=uid_WB6ZrwAGHJ0KLAXLjA8j8w_10:2120,uid_WB6aQQAGpZkKLNwFPgmnbA_10:2120

Artis

I can't replicate the issue in Chrome - window.location.href should always return the current pages url the only instance that I can think that it might not is if it had been altered using the HTML5 History API. Is there a particular browser or process that you used to produce this issue? – Makell

@Makell Thanks for answer, I would add extra option to my log to see the client user-agent and I'll inform you as soon as possible – Artis

@Makell Some examples of client UA added to question – Artis

I still couldn't reproduce the issue using UA spoofing and chrome "emulation". I thought I'd mentioned before but are you sure that it's logging location.href and not document.referrer? Only other thought I had is maybe the issue isn't occurring on the home page - perhaps logging the GET request into an inline script/div so that it can be passed back via your logging script might be helpful so that we can manually map a request to a url and try to narrow down how we can reproduce the issue – Makell

@Makell Yes I'm sure about using location.href and unfortunately I didn't understand what did you say. :( – Artis

@HosseinShahsahebi : are you looking the url in chrome emulator or perticular device. If you using device try using multiple browser, there may be possiblity that some plugin redirecting your URL via google to increase google ads hit count. You can also try with other devices too. – Aqua

@ShoaibKonnur These info are offline, means that some user goes to a known website that has our js code, Then we'll get it's current URL via location.href and send it to the server. Finally server will generate the log with received URL – Artis

Sorry I don't have access to those devices so can't test that. What I was getting at is at the moment your script is logging an incorrect URL and we don't know why or what the browser requested, however your server does, so if we can add the requested URL (and possibly the referrer) to the logged data you have a more specific set of circumstances so that we can reproduce the issue then debug the issue further. – Makell

"a js file that will be included in our customers sites" How? It could be an iframe issue. – Wiles

@zeroflagL JS file is included directly by webmaster of those websites, our JS will gather some data including page URL by using location.href and finally will send generate an Iframe with the URL containing data. It's important to note that the url will encode and then appended to main URL – Artis

@Makell Thanks for reply, Currently I have expected applicant domain and I can say that e.g. something.com send this irrelevant url as its href. but the referrer not exist in our request URL. Does it have any effect on diagnosing the problem – Artis

Main thing is knowing the URL I think - referrer can sometimes be helpful as it's one more step to follow but for most issues it's not a huge factor. – Makell

tell the complete line of code used to get the location href?? – Anachronous

Is the url generated dynamically from js, like something a router would do? If so, have you tried to encoding the url after getting the href location. i.e. encodeURIComponent – Jorin

@HosseinShahsahebi do you try do this? var myurl = location.origin + location.pathname; is the same but if not work location.href ... – Shivery

The applicant UA you provided are all android 4. Does this bug happens only on that version of android or does you could reproduce it with every call ? Could you provide a snippet of the code you use to send the location.href to your server ? – Wilheminawilhide

@Wilheminawilhide I added what you want to the question, you could read it more accurate there – Artis

@Wilheminawilhide these logs are generated by other users all around the web and I just gather them. I didn't try to reproduce it by myself but your right, as I see this will be happen just on Android 4.* – Artis

Answer 1

try do this

var myurl = location.origin + decodeURIComponent(location.pathname);

basically is the same that do location.href but it should works

Shivery

@Hossein Shahsahebi did you have some time to check this? – Shivery

Answer 2

I wasn't actually able to reproduce the bug, in all the few testing I did your code got the correct location.href.

The only problem that I can think of that could do that is that you are creating your link when you are building your class.

var my_obj = {
     /*...*/
     url: "http://sd.domain.ir/index.php?r=" + Math.floor(Math.random() * (1e8 + 1)) + "0&ref=" + (window.btoa ? btoa(location.href) : "ie") + "&responsive=" + (document.querySelector('meta[name="viewport"][content*="width=device-width"]') ? "yes" : "no") + "&params=",
     /*...*/
}
my_obj.init();

Doing it like this means that the url is actually populated when the .js file is loaded.

What you get it is definitely a referrer, like if in old versions of the android browser you actually load the script before location.href changes, or there is some sort of prefetching (like the browser load stuff from the next page before actually going to the next page) going on.

Getting location.href after the dom has loaded should be better. You could try to check what state you are in before getting the href:

var my_obj = {
     init: function(){
            my_obj.url =  "http://sd.domain.ir/index.php?r=" +Math.floor(Math.random() * (1e8 + 1)) + "0&ref=" + (window.btoa ? btoa(location.href) : "ie") + "&responsive=" + (document.querySelector('meta[name="viewport"][content*="width=device-width"]') ? "yes" : "no") + "&params=";
     }
     /*...*/,
     url: ""
}

if(document.readyState == "uninitialized" || document.readyState == "loading "  || document.readyState == "loaded"){
    document.onreadystatechange = function(){
        if (document.readyState == "interactive") {
            my_obj.init();
         }
    } 
}else{
   my_obj.init();
}

Wilheminawilhide

Thanks for your reply, but the problem is initiating url_show on readystatechange is too late to use the variable. – Artis

but I changed the code to handle this variable as late as enough – Artis

@HosseinShahsahebi I was gonna ask if you could make it work if you waited for readystate to change from uninitialized to loading or loaded, Better yet, you could check your init function for your current state, to see if you should create immediately or wait. – Wilheminawilhide

I tried the scenario you said but there was no success there, thank you for your help – Artis