Someone reported (thanks!) that a download link for a torrent was not working properly (torrent: link).
I already suspected at first that there might be a strange character in there, but all characters work fine on Windows and are accepted as valid (including the semicolon). After a bit of checking it turns out the problematic browser is IE7. It cuts the filename at the semicolon. After checking the code again I understand why it could possibly, remotely, happen granted that the developers for IE7 are a bunch of tards and are keen on ignoring common sense and anything that requires brain cells.
header("Content-Type: application/x-bittorrent");
header("Content-Disposition: attachment;
filename=\"" . $torrent["filename"] . "\"");
Apparently the semicolon is used to separate multiple arguments in content headers, but this should obviously not be the case when it occurs in a “string”.
Google confirms this issue, though I was surprised at how little results popped up. (source: link, click “Horrors with Internet Explorer 7 [modified]”)
but then the problem comes with “;” (semicolon) in filename. If we have a filename like “IE 7 Browser; Cruel Browser.jpg”, the content disposition dialogue shows as
I can not tell you how overjoyed I am to find bugs like this Internet Explorer 7, really.
If anyone has IE8 can you try and see if they’ve fixed it yet? (I’ve fixed it for BoxTorrents already so you’ll need to look elsewhere).
–Jarudin–
aw, come on, micro$oft would never pull a fail. they MEANT to do that. just watch, it’s gonna make M$ another billion by the time it’s all said and done…
The only thing Microsoft ever got something done is Windows XP and maybe Windows 7.
Back to topic: I hate IE as it takes forever for it to load and I can’t run other programs like play video games while surf the web as it lags me too much.
Pingback: talk jokes » Blog Archive » Re: Killerspiele
Hey Jarudin,
Technically speaking using a semicolon in any MIME header subdivision is outside of spec, since the header args aren’t quoted. Tomcat, WebDAV and a few other server architectures also have this “bug” – Fr’instance, WebDAV will truncate an upload file name at “;”, and some email clients will choke on “;” in an attachment’s filename. Some filesystems don’t allow “;” as a legal character in a filename (Old Sun, some UNIX variants, etc.). A lot of apps and protocols allow for escaping of the semicolon but that can lead to malicious code injection in upload headers, etc.
Tested in IE8, it also will not accept semicolons, other than as separators:
[code]
header(“Content-Type: image/jpeg”);
$filename=”Borked;Filename.jpg”;
header(“Content-Disposition: attachment;filename=\”” . $filename .”\””);
echo “spewspewspewnotreallyajpegfilespew”;
[/code]
On the other hand, IE8 has developer tools that kick the crap out of FF and Chrome put together.
Update: urlencoding the filename works.
[code]
header(“Content-Type: image/jpeg”);
$filename=”Borked%3BFilename.jpg”;
header(“Content-Disposition: attachment;filename=\”” . $filename .”\””);
echo “spewspewspew”;
[/code]
That will give you a download named “Borked;Filename.jpg” in IE8.
I was mainly referencing to the dilemma that in Windows ; is a valid character, but apparently not when served in IE7. I’ll try the urlencoding.
–Jarudin–
Pingback: bIE7/b Fail -_- « BoxTorrents Blog « Windows 7 Live Info