Bug 314975 – "Open [Image/Video] in New Tab" contextual menu item caused double percent-encoding for unencoded URLs

• Component: New Bugs
• Status: RESOLVED FIXED

[Alex Chan]

Created attachment 479696 [details]
minimal HTML page to reproduce bug

Overview: when right-clicking a media element (image/video) whose src attribute contains spaces or packets that have not been manually percent-encoded in the source HTML, selecting "Open Image/Video in New Tab" causes Safari to percent-encode the URL twice, resulting in a broken link/404 error in the new tab.

Steps to reproduce:

1. Create a media file with spaces and square brackets in the URL, for example "flower [A].jpg"
2. Embed it in an HTML page without per-encoding the `src` attribute, e.g. `<img src="flower [A].jpg">`
3. Open the web page, and verify the media renders correctly on the initial page load
4. Right-click the media file and select "Open Image/Video in New Tab".

A sample minimal HTML page is attached.

The bug is reproducible with images and videos, and when the web page is served over http:// and file:// protocols.

Expected results: a new tab opens to the correctly encoded URL.

Actual results: the new tab attempts to load a double-encoded URL, and the server returns a 404 Not Found error.

Worked example:

* Original filename: `flower [A].jpg`
* In the HTML: `<img src="flower [A].jpg">`
* Expected new tab URL: `flower%20%5BA%5D.jpg`
* Actual new tab URL: `flower%25%20%5BA%5D.jpg`

This looks like multiple, conflicting encoding passes:

* the first pass converts ` ` to `%20`
* the second pass converts `%20` to `%2520`, `[` to `%5B`, `]` to `%5D`

Affected versions: Safari version 26.4 (20624.1.16.18.2) on macOS 15.7.5 (24G624).

[Alex Chan]

You can also trigger this behaviour if the space is encoded but the square brackets are not, for example:

<img src="flower%20[A].jpg">

[Alex Chan]

But it does not reproduce if the URL is fully encoded, for example:

<img src="flower%20%5BA%5D.jpg">

[Radar WebKit Bug Importer]

<rdar://problem/177297247>

[Alexey Proskuryakov]

Pull request: https://github.com/WebKit/WebKit/pull/65074

[EWS]

Committed 313430@main (656a3201fd4e): <https://commits.webkit.org/313430@main>

Reviewed commits have been landed. Closing PR #65074 and removing active labels.