455925 - Improper handling of %nn in filename of mail attachment

Status: RESOLVED DUPLICATE of bug 379053

(Thunderbird :: General, defect)

Description

[Charles]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.2.152.1 Safari/525.19
Build Identifier: 2.0.0.16 (20080708)

If a filename contains a `%' followed by two numbers, for example : %20 for a space, or %40 for a @, Thunderbird improperly looks for a filename with the translated character. For example: looks for `@' instead of `%40' in the filename.

Reproducible: Always

Steps to Reproduce:
1.Create a file
2.Rename the file with %40 somewhere in the name
3.Attach the file as an e-mail attachment
4 [review].Attempt to send the file.
5.It will fail with:

Sending of message failed.
Unable to open the file <<path>>\<<filename with `@' instead of `%40'>>. Check your 'Temporary Directory' setting.

6.WITHOUT CLOSING OR CHANGING THE E-MAIL, rename the file and substitute `@' for `%40'.
7.Click send. (the e-mail will send, even though the attachment is still listed as %40)

Actual Results:  
%40 is interpreted, improperly, as @, instead of taken as verbatim as `%40'.

Expected Results:  
The software should allow `%40' as a valid string within a filename.

I don't know if this can be exploited to gain computer access using special escape characters. Such action is beyond my skill as a programmer.

Comment 1

[Wayne Mery (:wsmwk)]

see this using trunk?