Bug 16354 – Complex urls in img tag are not escaped correctly

• Status: NEW
• Component: New Bugs

[Mirco Macrelli]

I'm writing a page with lots of complex math formulas and decided to use mimeTeX to display them to my visitors. In firefox the page works ok but on safari the images created by the script are wrong.

[Alexey Proskuryakov]

I cannot reproduce this with shipping Safari or TOT on Windows XP, Tiger or Leopard.

[David Kilzer (:ddkilzer)]

I see a difference between "Bad" and "Good" images with a local debug build of WebKit r28516 with Safari 3.0.4 (523.12) on Mac OS X 10.4.11 (8S165).

Since the URL is not properly encoded in the HTML source, I'm guessing WebKit (or CFNetwork) is not properly encoding the string of characters sent to the server (or encoding them differently than Firefox).

[David Kilzer (:ddkilzer)]

MSIE 7 on Windows XP SP2 behaves the same way as Safari on Tiger does.

[David Kilzer (:ddkilzer)]

Here is the GET request from Firefox 2.0.0.9:

GET /mimetex/G(%5Cvec%7Bk%7D,t-t')%20=%20i%5Clim_%7B%5Ceta%5Crightarrow%200%5E+%7D%5Cint_%7B-%5Cinfty%7D%5E%7B+%5Cinfty%7D%5Cfrac%7Bd%5Comega%7D%7B2%5Cpi%7De%5E%7Bi%5Comega(t-t')%7D%5Cfrac%7B1%7D%7B%5Clangle%5CPsi_0|%5CPsi_0%5Crangle%7D%20%5Cleft%20%5B%20%5Csum_n%20%5Cfrac%7B|%5Clangle%5CPsi%5E%7BN+1%7D_n|%5Chat%7Ba%7D%5E%7B%5Cdagger%7D_k|%5CPsi_0%5Crangle|%5E2%7D%7B%5Comega%20-%20%5Cmu%20-%20w_n%5E%7BN+1%7D+i%5Ceta%7D%20+%20%5Csum_n%20%5Cfrac%7B|%5Clangle%5CPsi%5E%7BN-1%7D_n|%5Chat%7Ba%7D_k|%5CPsi_0%5Crangle|%5E2%7D%7B%5Comega%20-%20%5Cmu%20+%20w_n%5E%7BN+1%7D-i%5Ceta%7D%20%5Cright%20%5D HTTP/1.1

And from Safari 3.0.4 (523.12) with a local debug build of WebKit r28516:

GET /mimetex/G(/vec{k},t-t')%20=%20i/lim_{/eta/rightarrow%200^+}/int_{-/infty}^{+/infty}/frac{d/omega}{2/pi}e^{i/omega(t-t')}/frac{1}{/langle/Psi_0|/Psi_0/rangle}%20/left%20[%20/sum_n%20/frac{|/langle/Psi^{N+1}_n|/hat{a}^{/dagger}_k|/Psi_0/rangle|^2}{/omega%20-%20/mu%20-%20w_n^{N+1}+i/eta}%20+%20/sum_n%20/frac{|/langle/Psi^{N-1}_n|/hat{a}_k|/Psi_0/rangle|^2}{/omega%20-%20/mu%20+%20w_n^{N+1}-i/eta}%20/right%20] HTTP/1.1

And from MSIE 7 for good measure:

GET /mimetex/G(/vec%7Bk%7D,t-t')%20=%20i/lim_%7B/eta/rightarrow%200%5E+%7D/int_%7B-/infty%7D%5E%7B+/infty%7D/frac%7Bd/omega%7D%7B2/pi%7De%5E%7Bi/omega(t-t')%7D/frac%7B1%7D%7B/langle/Psi_0%7C/Psi_0/rangle%7D%20/left%20[%20/sum_n%20/frac%7B%7C/langle/Psi%5E%7BN+1%7D_n%7C/hat%7Ba%7D%5E%7B/dagger%7D_k%7C/Psi_0/rangle%7C%5E2%7D%7B/omega%20-%20/mu%20-%20w_n%5E%7BN+1%7D+i/eta%7D%20+%20/sum_n%20/frac%7B%7C/langle/Psi%5E%7BN-1%7D_n%7C/hat%7Ba%7D_k%7C/Psi_0/rangle%7C%5E2%7D%7B/omega%20-%20/mu%20+%20w_n%5E%7BN+1%7D-i/eta%7D%20/right%20] HTTP/1.1

[David Kilzer (:ddkilzer)]

Heh...the problem is probably that Safari and MSIE are changing '\' to '/' while Firefox is encoding '\' to %5C.  I wonder what rule Firefox is using to decide whether to treat a backslash as a directory separator versus a character to encode?

[Mirco Macrelli]

It's interesting that if you do a copy and paste of the uri in the address bar the images is displayed correctly. Could it be that safari treat the two uri in different manners?

[David Kilzer (:ddkilzer)]

(In reply to comment #6)
> It's interesting that if you do a copy and paste of the uri in the address bar
> the images is displayed correctly. Could it be that safari treat the two uri in
> different manners?

Yes, that is possible.  It's also good to know!

[David Kilzer (:ddkilzer)]

(In reply to comment #6)
> It's interesting that if you do a copy and paste of the uri in the address bar
> the images is displayed correctly. Could it be that safari treat the two uri in
> different manners?

GET request from Safari address bar (which works):

GET /mimetex/G(\vec{k},t-t')%20=%20i\lim_{\eta\rightarrow%200^+}\int_{-\infty}^{+\infty}\frac{d\omega}{2\pi}e^{i\omega(t-t')}\frac{1}{\langle\Psi_0|\Psi_0\rangle}%20\left%20[%20\sum_n%20\frac{|\langle\Psi^{N+1}_n|\hat{a}^{\dagger}_k|\Psi_0\rangle|^2}{\omega%20-%20\mu%20-%20w_n^{N+1}+i\eta}%20+%20\sum_n%20\frac{|\langle\Psi^{N-1}_n|\hat{a}_k|\Psi_0\rangle|^2}{\omega%20-%20\mu%20+%20w_n^{N+1}-i\eta}%20\right%20] HTTP/1.1

[Mark Rowe (bdash)]

From KURL.cpp:
286	    // for compatibility with Win IE, we must treat backslashes as if they were slashes, as long as we're not dealing with the javascript: schema
287	    DeprecatedString substitutedRelative;
288	    bool shouldSubstituteBackslashes = relative.contains('\\') && !relative.startsWith("javascript:", false);
289	    if (shouldSubstituteBackslashes) {
290	        substitutedRelative = substituteBackslashes(relative);
291	    }

[Alexey Proskuryakov]

(In reply to comment #2)
> I see a difference between "Bad" and "Good" images with a local debug build of
> WebKit r28516 with Safari 3.0.4 (523.12) on Mac OS X 10.4.11 (8S165).

Ah, now I see - I was expecting a broken image or something. My bad.