Question

We have a web site builder in use by thousands of users, and for some reason, our web servers are receiving a glut of requests to the urls “inherit” and “null”. We have no idea what is carrying out these requests. It’s happening pretty frequently, though still for a minority of the time, and they come from multiple customers. Here’s what we’ve ruled out:

1. Our web sites do not appear to contain any links to “inherit” or “null” URLs, so we don’t think our AJAX code is making the requests. None of us are able to get this to happen from our web browsers. Our belief that there are no links to these URLs in our page is boosted by the fact that some of the bad URLs are appended to the ends of URLs that appear to have belonged to web sites that used to be hosted elsewhere.

2. We don’t think a bot is responsible. Most of the bad requests are from authenticated customers.

3. We don’t think a common web browser is performing these requests. I’ve visited the site in IE 8, IE 6, Firefox, Chrome, Safari (both Windows and Mac), and Opera.

My favored theory is that there is a very common browser plugin/extension, an uncommon-but-common-enough web browser, or some malware that is making these requests as users browse/admin their sites. Have any of you seen requests of this form before? Where are these coming from?

Answer 1

I found the problem.

Apparently, IE 6 & 7 do not properly handle setting the CSS cursor property to inherit. It decides to interpret that as cursor: url(inherit). That was the source of our “/inherit” URLs. The source of the “/null” requests was that we had, through jQuery, set the CSS cursor property to null in hopes that it would remove the property. Rather, IE interprets setting it to null as setting it to url(null).

To fix this, we set cursor to auto instead of inherit, and used an empty string to clear the property instead of null.