[Clipart] upload script problem?

[Stephen Silver]

Jonadab wrote:

> However, in terms of the ComtuxAPS Logo 2 contribution,
> I think I see what happened, as follows:
> 
> 1.  The user submitted the file itself without specifying the
>      needed metadata, probably using the form on the front page.
> 2.  The upload script attempted to place the submitted file
>      into the value attribute of the (hidden) userfile input;
>      however, this appears not to work for binary files, for
>      reasons that are not clear to me.

This is the problem.  It would also be a problem some text files.
The file is treated as being Windows codepage 1252 (that is, Latin-1,
but with Microsoft-specific stuff in the unused region 80-9F) and is
encoded mainly as HTML entities and character references.  But the
page is UTF-8, so when these things are converted back to bytes, you
get something completely different than you started with.

For a PNG file, you start off with this:

  89 50 4E 47 0D 0A 1A 0A ...

After one iteration this becomes

  E2 80 B0 50 4E 47 0D 0A 1A

assuming that truncation occurs at 1A, which is an old end-of-file
marker for text files.  (The PNG signature is designed to be easily,
or even inevitably, corrupted when treated as text.)  After another
iteration it becomes

  C3 A2 E2 82 AC C2 B0 50 4E 47 0D 0A 1A

which is exactly the contents of comtuxaps_logo_2_comtuxa_01.png.

Similarly, the contents of kansasflag_dave_reckonin_01.wmf are the
result of applying one iteration of this process to the first four
bytes of a placeable WMF file (which are D7 CD C6 9A).  Truncation
in this case must have been caused by null bytes.

-- 
Stephen Silver