32140 2009-12-03 19:10:45 -0800 REGRESSION(r50072): Mailman administrative functionality is broken 2009-12-20 13:32:21 -0800 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Mac OS X 10.6 RESOLVED FIXED http://src.macosforge.org/webkit-post-data-bug-test.php HasReduction, InRadar, Regression P2 Normal --- 1 wsiegrist ap abarth ap darin dbates mrowe webkit.review.bot oldest_to_newest 168619 0 wsiegrist 2009-12-03 19:10:45 -0800 Reduced case: http://src.macosforge.org/webkit-post-data-bug-test.php If you check a box and hit the corresponding submit button, you'll notice the checkbox name "abc%40def" is encoded as "abc%2540def" only when multipart encoding is used. I would expect the field name to be the same in both cases. Firefox 3.5.5 and Safari 4.0.4 do not encode the name. I can reproduce with nightly r51580. 168620 1 mrowe 2009-12-03 19:15:41 -0800 This regressed in <http://trac.webkit.org/changeset/50072>. It breaks administrative functionality within the Mailman interface that is used on lists.webkit.org. 168622 2 mrowe 2009-12-03 19:32:20 -0800 Why did we choose to URL encode field names within these headers? The only thing that RFC 2388, the multipart/form-data specification, has to say about encoding of field names is: > Field names originally in non-ASCII character sets may be encoded > within the value of the "name" parameter using the standard method > described in RFC 2047. RFC 2047, Message Header Extensions for Non-ASCII Text, appears to discuss the use of quoted-printable encoding. The cases we are concerned about a clearly not non-ASCII, but this does seem to directly conflict with our decision to URL encode the field names. 168623 3 mrowe 2009-12-03 19:32:42 -0800 <rdar://problem/7443458> 168668 4 ap 2009-12-03 22:15:06 -0800 Percent escaping was chosen randomly, we can definitely try another encoding form. Encoding the percent sign itself was a poorly thought through last minute change, and it can be just removed from the set of encoded characters for an easy fix. I did not know about RFC 2388, and I do not know if anyone follows it. 170560 5 44644 ap 2009-12-10 15:53:24 -0800 Created attachment 44644 proposed fix 170564 6 webkit.review.bot 2009-12-10 15:57:06 -0800 style-queue ran check-webkit-style on attachment 44644 without any errors. 170570 7 44644 mrowe 2009-12-10 16:17:36 -0800 Comment on attachment 44644 proposed fix I don’t understand why we *were* using URL encoding for field names. I don’t understand why we’re now inventing a custom encoding for these fields that looks by all appearances to be URL encoding, and yet cannot be decoded by the other end. 170575 8 ap 2009-12-10 16:23:36 -0800 Mark has suggested an interesting idea for future consideration - even though RFC 2388 doesn't apply to ASCII characters, we can still use its form of encoding, e.g. =0a. But I don't think we should be changing this now. 170584 9 44644 darin 2009-12-10 16:35:08 -0800 Comment on attachment 44644 proposed fix This change is clearly good. Maybe we can find a better form of encoding than %-encoding in the future, but this will get rid of the regression without reintroducing the problem we originally were fixing by quoting the name. r=me 170588 10 ap 2009-12-10 16:42:44 -0800 Committed <http://trac.webkit.org/changeset/51973>. 173803 11 dbates 2009-12-20 13:19:38 -0800 Marking this bug as fixed since it was committed in changeset 51973 <http://trac.webkit.org/changeset/51973>. If this is a mistake then reopen this bug. 173810 12 ap 2009-12-20 13:32:21 -0800 This was just an oversight - thanks for noticing! 44644 2009-12-10 15:53:24 -0800 2009-12-10 16:35:08 -0800 proposed fix percent.txt text/plain 4953 ap SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA1MTk2OCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTUgQEAKKzIwMDktMTItMTAgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEBhcHBs ZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTMyMTQwCisgICAgICAgIFJF R1JFU1NJT04ocjUwMDcyKTogTWFpbG1hbiBhZG1pbmlzdHJhdGl2ZSBmdW5jdGlvbmFsaXR5IGlz IGJyb2tlbgorCisgICAgICAgIFRlc3Q6IGh0dHAvdGVzdHMvbWlzYy9wZXJjZW50LXNpZ24taW4t Zm9ybS1maWVsZC1uYW1lLmh0bWwKKworICAgICAgICAqIHBsYXRmb3JtL25ldHdvcmsvRm9ybURh dGFCdWlsZGVyLmNwcDogKFdlYkNvcmU6OmFwcGVuZFF1b3RlZFN0cmluZyk6IERvbid0IGVuY29k ZSBwZXJjZW50CisgICAgICAgIHNpZ24sIHdlIG5ldmVyIGhhZCBhIGdvb2QgcmVhc29uIHRvIGRv IHRoYXQuCisKIDIwMDktMTItMTAgIFN0ZXBoZW4gV2hpdGUgIDxzZW5vcmJsYW5jb0BjaHJvbWl1 bS5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRGltaXRyaSBHbGF6a292LgpJbmRleDogV2Vi Q29yZS9wbGF0Zm9ybS9uZXR3b3JrL0Zvcm1EYXRhQnVpbGRlci5jcHAKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g V2ViQ29yZS9wbGF0Zm9ybS9uZXR3b3JrL0Zvcm1EYXRhQnVpbGRlci5jcHAJKHJldmlzaW9uIDUx OTY0KQorKysgV2ViQ29yZS9wbGF0Zm9ybS9uZXR3b3JrL0Zvcm1EYXRhQnVpbGRlci5jcHAJKHdv cmtpbmcgY29weSkKQEAgLTEyNyw5ICsxMjcsNiBAQCBzdGF0aWMgdm9pZCBhcHBlbmRRdW90ZWRT dHJpbmcoVmVjdG9yPGNoCiAgICAgICAgIGNhc2UgJyInOgogICAgICAgICAgICAgYXBwZW5kKGJ1 ZmZlciwgIiUyMiIpOwogICAgICAgICAgICAgYnJlYWs7Ci0gICAgICAgIGNhc2UgJyUnOgotICAg ICAgICAgICAgYXBwZW5kKGJ1ZmZlciwgIiUyNSIpOwotICAgICAgICAgICAgYnJlYWs7CiAgICAg ICAgIGRlZmF1bHQ6CiAgICAgICAgICAgICBhcHBlbmQoYnVmZmVyLCBjKTsKICAgICAgICAgfQpJ bmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0No YW5nZUxvZwkocmV2aXNpb24gNTE5NjkpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtp bmcgY29weSkKQEAgLTEsMyArMSwxNCBAQAorMjAwOS0xMi0xMCAgQWxleGV5IFByb3NrdXJ5YWtv diAgPGFwQGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MzIxNDAK KyAgICAgICAgUkVHUkVTU0lPTihyNTAwNzIpOiBNYWlsbWFuIGFkbWluaXN0cmF0aXZlIGZ1bmN0 aW9uYWxpdHkgaXMgYnJva2VuCisKKyAgICAgICAgKiBodHRwL3Rlc3RzL21pc2MvcGVyY2VudC1z aWduLWluLWZvcm0tZmllbGQtbmFtZS1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGh0 dHAvdGVzdHMvbWlzYy9wZXJjZW50LXNpZ24taW4tZm9ybS1maWVsZC1uYW1lLmh0bWw6IEFkZGVk LgorICAgICAgICAqIGh0dHAvdGVzdHMvbWlzYy9yZXNvdXJjZXMvcGVyY2VudC1zaWduLWluLWZv cm0tZGF0YS1maWVsZC1uYW1lLmNnaTogQWRkZWQuCisKIDIwMDktMTItMTAgIEFscGhhIExhbSAg PGhjbGFtQGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdlZCBieSBFcmljIENhcmxzb24u CkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL21pc2MvcGVyY2VudC1zaWduLWluLWZvcm0t ZmllbGQtbmFtZS1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0cC90 ZXN0cy9taXNjL3BlcmNlbnQtc2lnbi1pbi1mb3JtLWZpZWxkLW5hbWUtZXhwZWN0ZWQudHh0CShy ZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9taXNjL3BlcmNlbnQtc2lnbi1p bi1mb3JtLWZpZWxkLW5hbWUtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDMg QEAKK1Rlc3QgZm9yIGJ1ZyAzMjE0MDogTWFpbG1hbiBhZG1pbmlzdHJhdGl2ZSBmdW5jdGlvbmFs aXR5IGlzIGJyb2tlbi4KKworUEFTUwoKUHJvcGVydHkgY2hhbmdlcyBvbjogTGF5b3V0VGVzdHMv aHR0cC90ZXN0cy9taXNjL3BlcmNlbnQtc2lnbi1pbi1mb3JtLWZpZWxkLW5hbWUtZXhwZWN0ZWQu dHh0Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KTmFtZTogc3ZuOm1pbWUtdHlwZQogICArIHRleHQvcGxhaW4KTmFtZTog c3ZuOmVvbC1zdHlsZQogICArIG5hdGl2ZQoKSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMv bWlzYy9wZXJjZW50LXNpZ24taW4tZm9ybS1maWVsZC1uYW1lLmh0bWwKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g TGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9taXNjL3BlcmNlbnQtc2lnbi1pbi1mb3JtLWZpZWxkLW5h bWUuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2h0dHAvdGVzdHMvbWlzYy9wZXJj ZW50LXNpZ24taW4tZm9ybS1maWVsZC1uYW1lLmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEs MTAgQEAKKzxmb3JtIG1ldGhvZD0icG9zdCIgYWN0aW9uPSJyZXNvdXJjZXMvcGVyY2VudC1zaWdu LWluLWZvcm0tZGF0YS1maWVsZC1uYW1lLmNnaSIgZW5jdHlwZT0ibXVsdGlwYXJ0L2Zvcm0tZGF0 YSI+Cis8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iYWJjJTQwZGVmIiB2YWx1ZT0idGVzdCI+Cis8 L2Zvcm0+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikgeworICAg IGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAgICBsYXlvdXRUZXN0Q29udHJv bGxlci53YWl0VW50aWxEb25lKCk7Cit9Citkb2N1bWVudC5mb3Jtc1swXS5zdWJtaXQoKTsKKzwv c2NyaXB0PgoKUHJvcGVydHkgY2hhbmdlcyBvbjogTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9taXNj L3BlcmNlbnQtc2lnbi1pbi1mb3JtLWZpZWxkLW5hbWUuaHRtbApfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCk5hbWU6IHN2 bjptaW1lLXR5cGUKICAgKyB0ZXh0L2h0bWwKCkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3Rz L21pc2MvcmVzb3VyY2VzL3BlcmNlbnQtc2lnbi1pbi1mb3JtLWRhdGEtZmllbGQtbmFtZS5jZ2kK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9taXNjL3Jlc291cmNlcy9wZXJj ZW50LXNpZ24taW4tZm9ybS1kYXRhLWZpZWxkLW5hbWUuY2dpCShyZXZpc2lvbiAwKQorKysgTGF5 b3V0VGVzdHMvaHR0cC90ZXN0cy9taXNjL3Jlc291cmNlcy9wZXJjZW50LXNpZ24taW4tZm9ybS1k YXRhLWZpZWxkLW5hbWUuY2dpCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDI2IEBACisjIS91c3Iv YmluL3BlcmwgLXcKKworcHJpbnQgIkNvbnRlbnQtdHlwZTogdGV4dC9odG1sXG5cbiI7IAorCitw cmludCAiPHA+VGVzdCBmb3IgPGEgaHJlZj0naHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTMyMTQwJz5idWcgMzIxNDA8L2E+OiBNYWlsbWFuIGFkbWluaXN0cmF0aXZlIGZ1 bmN0aW9uYWxpdHkgaXMgYnJva2VuLjwvcD4iOworcHJpbnQgIjxwcmU+IjsKKworaWYgKCRFTlZ7 J1JFUVVFU1RfTUVUSE9EJ30gZXEgIlBPU1QiKSB7CisgICAgcmVhZChTVERJTiwgJHJlcXVlc3Qs ICRFTlZ7J0NPTlRFTlRfTEVOR1RIJ30pCisgICAgICAgICAgICAgICAgfHwgZGllICJDb3VsZCBu b3QgZ2V0IHF1ZXJ5XG4iOworICAgIHByaW50ICRyZXF1ZXN0OworfSBlbHNlIHsKKyAgICBwcmlu dCAiV3JvbmcgbWV0aG9kOiAiIC4gJEVOVnsnUkVRVUVTVF9NRVRIT0QnfSAuICJcbiI7Cit9IAor CitwcmludCAiPC9wcmU+PHNjcmlwdD5cbiI7CitwcmludCAidmFyIHByZSA9IGRvY3VtZW50Lmdl dEVsZW1lbnRzQnlUYWdOYW1lKCdwcmUnKVswXTtcbiI7CitwcmludCAiaWYgKHByZS50ZXh0Q29u dGVudC5tYXRjaCgnYWJjJTQwZGVmJykpXG4iOworcHJpbnQgIiAgZG9jdW1lbnQud3JpdGUoJ1BB U1MnKVxuIjsKK3ByaW50ICJlbHNlXG4iOworcHJpbnQgIiAgZG9jdW1lbnQud3JpdGUoJ0ZBSUwn KVxuIjsKK3ByaW50ICJpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKSB7XG4iOworcHJp bnQgIiAgcHJlLnNldEF0dHJpYnV0ZSgnc3R5bGUnLCAnZGlzcGxheTpub25lJyk7XG4iOworcHJp bnQgIiAgbGF5b3V0VGVzdENvbnRyb2xsZXIubm90aWZ5RG9uZSgpO1xuIjsKK3ByaW50ICJ9XG4i OworcHJpbnQgIjwvc2NyaXB0PlxuIjsKClByb3BlcnR5IGNoYW5nZXMgb246IExheW91dFRlc3Rz L2h0dHAvdGVzdHMvbWlzYy9yZXNvdXJjZXMvcGVyY2VudC1zaWduLWluLWZvcm0tZGF0YS1maWVs ZC1uYW1lLmNnaQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fCk5hbWU6IHN2bjpleGVjdXRhYmxlCiAgICsgKgoK