Bug 5291

Summary:

FORM multipart/form-data with GET method issue

Product:

WebKit

Reporter:

Robert Klep <robert>

Component:

Forms

Assignee:

Nobody <webkit-unassigned>

Status:

VERIFIED FIXED

Severity:

Normal

CC:

Priority:

Version:

420+

Hardware:

Mac

OS:

OS X 10.4

URL:

http://feedo.nl

Attachments:

Description	Flags
test case	none
proposed fix	darin: review-
revised fix	darin: review+

Robert Klep

Reported 2005-10-07 09:42:13 PDT

Safari handles FORM-submits which set ENCTYPE to "multipart/form-data" using the "GET" method incorrectly. Instead of ignoring this particular ENCTYPE (which is only valid for "POST" requests), Safari submits the MIME-data as a querystring. I ran into this issue on http://feedo.nl . I'm attaching a small testcase which isolates and demonstrates the issue below. -snip- <html> <body> <form enctype="multipart/form-data" method="get" action="."> <input type="hidden" name="hidden" value="I am hidden"> <input type="submit" value="press me"> </form> </body> </html>

Attachments
test case (290 bytes, text/html) 2006-01-04 05:12 PST, Alexey Proskuryakov	no flags	Details
proposed fix (4.44 KB, patch) 2006-01-04 06:06 PST, Alexey Proskuryakov	darin: review-	Details Formatted Diff Diff
revised fix (11.06 KB, patch) 2006-01-05 03:06 PST, Alexey Proskuryakov	darin: review+	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.

Alexey Proskuryakov

Comment 1 2006-01-04 05:12:16 PST

Created attachment 5481 [details] test case Same test case, in an attachment.

Alexey Proskuryakov

Comment 2 2006-01-04 05:22:32 PST

http://www.w3.org/TR/REC-html40/interact/forms.html#h-17.13.3

Alexey Proskuryakov

Comment 3 2006-01-04 06:06:47 PST

Created attachment 5482 [details] proposed fix

Darin Adler

Comment 4 2006-01-04 10:41:20 PST

Comment on attachment 5482 [details] proposed fix This patch looks OK, but I think we can do better. The way the code is currently written, behavior is different based on the order of the enctype and method attributes. This patch doesn't fix that. In particular, if enctype="multipart/form-data" before after method="get" then the method will be GET, but if method="get" comes before enctype="multipart/form-data" then the method will be POST. We should remove all the order dependencies -- this patch removes one of them.

Alexey Proskuryakov

Comment 5 2006-01-05 03:06:06 PST

Created attachment 5492 [details] revised fix Also don't assume that multipart/form-data implies POST; added more test cases.

Darin Adler

Comment 6 2006-01-05 09:44:31 PST

Comment on attachment 5492 [details] revised fix So the old code that assumed multipart/form-data implied post was incorrect. Did you test other browsers and prove that?

Alexey Proskuryakov

Comment 7 2006-01-05 09:53:43 PST

(In reply to comment #6) One of the new tests (form-get-multipart3.html) checks for this; it succeeds on Firefox. Well, it only checks the URI automatically, but I have ran this test from an HTTP server, and the method observed via tcpflow was indeed GET. <http://nypop.com/~ap/webkit/form-get-multipart3.html> I haven't checked IE.

Darin Adler

Comment 8 2006-01-06 06:55:34 PST

Comment on attachment 5492 [details] revised fix r=me

Alexey Proskuryakov

Comment 9 2006-01-06 07:53:53 PST

Reporter, please verify the fix on http://feedo.nl - I couldn't find how to reproduce the problem there. A build containing this fix should be available tomorrow from <http://nightly.webkit.org>.

Robert Klep

Comment 10 2006-01-07 00:25:42 PST

(In reply to comment #9) WebKit-CVS-2006-01-07 07-56-45 GMT has fixed the issue, http://feedo.nl works :-)

Note You need to log in before you can comment on or make changes to this bug.