366530 - emprosnet.gr - Broken character encoding makes articles display as source

Status: RESOLVED INCOMPLETE

(Tech Evangelism Graveyard :: Other, defect)

Description

[ngatsiou]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; el; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; el; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1

When you choose a hyperlink, the page is not displayed correctly.The code can be seen instead of the nornal web page.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.



My PC configuration:
Amd 3500+ 64bit, 512DDR Ram, 160GB HD,WindowsXP SP2,firefox 2.0.1

Comment 1

[Phil Ringnalda (:philor)]

Something horrible is being done to the character encoding of the parts they're assembling to make that page - the part that displays as HTML source has a 00 between every actual character, which smontagu described as looking rather "like iso-8859-7 that has been converted to UTF-16 by something that thought it was iso-8859-1"

However, Safari apparently just ignores the 00s and happily displays the page "correctly," and I assume IE does the same.

Comment 2

[Phil Ringnalda (:philor)]

IE does in fact display it "correctly," behavior that we probably don't want to emulate since it would involve adding ourselves to the list of vulnerable browsers for items 19 and 20 in http://ha.ckers.org/xss.html

It's interesting that IE7 is only listed as vulnerable to "<scr\0ipt>" and not "<img src=java\0script:..." - offhand, it looks like they might only take notice of nulls in URI schemes which are "javascript" (at least, they produce working mailto: links, which are the only absolute URI I found on that site).

Comment 3

[Boris Zbarsky [:bzbarsky]]

Yeah, this looks like evang to me.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

I even remember asking Boris if we should follow IE on this when I was looking at bug 264956 and we rejected it then (to make life easier on sanitizers).

Comment 5

[Phil Ringnalda (:philor)]

Ok, thanks, gentlemen: evangelism it is.

Comment 6

[Chris Lawson (gone)]

INCOMPLETE due to lack of activity since the end of 2009.

If someone is willing to investigate the issues raised in this bug to determine whether they still exist, *and* work with the site in question to fix any existing issues, please feel free to re-open and assign to yourself.

Sorry for the bugspam; filter on "NO MORE PRE-2010 TE BUGS" to remove.