webpositive pug file

[AlienSoldier]

Sometime netpositive download a file called Pug, out of the blue. It is a black gif or png picture with a single white pixel in the center

[pulkomandy]

It probably comes from one of the websites you visit. identifying which one would help.

[AlienSoldier]

I remember getting it once at ​http://www.neogaf.com/forum/forumdisplay.php?f=2 but i also got it elsewere 3 or 4 time. I can't reproduce it at will. File is always called pug.

I no longer have those in my history, i will copy the url associated with it when i get it next time.

[AlienSoldier]

Just got one by loading the page i linked.

url as copied from web+ download window: ​http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDQmdGw9MTI5NjAw&piggybackCookie=uid:KCOr6qAODdRKXv5r-FYIYgZv2Co

[pulkomandy]

This server seems to properly set the Content-Type header (well, except that a charset on a gif file doesn't make a lot of sense):

  HTTP/1.1 200 OK
  Date: Mon, 16 Jun 2014 15:51:08 GMT
  Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
  Set-Cookie: KRTBCOOKIE_372=6575-uid:KCOr6qAODdRKXv5r-FYIYgZv2Co&KRTB&10110-uid:KCOr6qAODdRKXv5r-FYIYgZv2Co&KRTB&10662-uid:KCOr6qAODdRKXv5r-FYIYgZv2Co; domain=pubmatic.com; expires=Sun, 14-Sep-2014 15:51:08 GMT; path=/
  Set-Cookie: PUBRETARGET=2844_1410709868; domain=pubmatic.com; expires=Sun, 14-Sep-2014 15:51:08 GMT; path=/
  Content-Length: 42
  P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
  P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
  Cache-Control: no-store, no-cache, private
  Pragma: no-cache
  Connection: close
  Content-Type: image/gif; charset=utf-8

So I'm not sure why Web+ decides to download this instead of showing it as a gif. Maybe because of the way it is injected in webpages.

[pulkomandy]

Should be fixed in HaikuWebKit 1.5.4. Can you still reproduce?

[AlienSoldier]

I took part of the afternoon trying to reproduce it and i was not able. Might just be that the sites that used to do this changed their backend. I guess we can close it and i will re-open if it happen again in a few months.