herd wrote:

Also got this with http://commons.wikimedia.org/wiki/File:Loading.gif

Bryan.TongMinh wrote:

Something went wrong when I tried to merge r43627 in the new-upload branch with r45378, it should detect '<a href='

Shouldn't that be '<a'*'href=', because <a title="woot i haxored you" href= would still do the trick of course.

herd wrote:

Shouldn't that be '<a'*'href=', because <a title="woot i haxored you" href=
would still do the trick of course.

IE specifically checks for '<A HREF' and since the only reason to have this detection is to pre-guess IE, it just needs to find '<A HREF'. I think.

(In reply to comment #3)

Shouldn't that be '<a'*'href=', because <a title="woot i haxored you" href=
would still do the trick of course.

Like the comments in IEContentAnalyzer.php say, the objective is to emulate IE's broken MIME detection code, not to be correct. You've just pointed out an obvious flaw in IE's algorithm, which IEContentAnalyzer duplicates because its purpose is to predict how IE will react.

Bryan.TongMinh wrote:

(In reply to comment #5)

(In reply to comment #3)

Shouldn't that be '<a'*'href=', because <a title="woot i haxored you" href=
would still do the trick of course.

Like the comments in IEContentAnalyzer.php say, the objective is to emulate
IE's broken MIME detection code, not to be correct. You've just pointed out an
obvious flaw in IE's algorithm, which IEContentAnalyzer duplicates because its
purpose is to predict how IE will react.

Note that this is UploadBase::detectScript, which is separate of IEContentAnalyzer. I don't exactly understand if and how those two functions are related and whether UploadBase::detectScript duplicated functions of IEContentAnalyzer.

Bryan.TongMinh wrote:

r56817.