Version: (using KDE Devel) Installed from: Compiled sources If images embedded in HTML as data urls (rfc2397) are served over http, they are not loaded. If the same html file is loaded as a local file, the embedded images show up normally.
Created attachment 2478 [details] testcase Try this testcase. Load it from this url, and the embedded images won't display. Download it, and load it locally, everything's working.
Created attachment 2482 [details] proposed fix Interestingly, the solution was to be found in a totally different place: KApplication::initUrlActionRestrictions I added a permission for any protocol to redirect to data urls.
Subject: Re: [Patch] permit redirections to data urls Am Mittwoch, 17. September 2003 09:34 schrieb Waldo Bastian: [...] > If you add > Class=:internet > to your data.protocol file they should be treated the same as http urls. Thanks, that works. However, it's conceptionally not quite true, because data urls "inherit" the network class from the embedding document. I. e. they should have all right if contained within a local document, and be subject to the http restrictions if contained within an http document. That means the following snippet always displays a warning dialog, even if it is contained in a local document: <a href="data:text/html,<a href="file:/etc/passwd">Peek at passwd</a>">Data url with link to local file</a> There's no sensible solution to this, is there? I'm leaving the bug open so I don't forget about it. > [...]
Changing title to reflect the findings
Yes, I guess khtml should check for data URLs and return the parent URL for the purpose of security validations. In fact, should a data: url ever be used as base-url at all? How should relative links be resolved in a document obtained from a data: url? I vaguely remember that I asked you this before.
I just checked how Mozilla behaves in this case: data:text/html,<a href="rel.html">relative</a> And the result is amazing. It renders a piece of text that looks like normal text, cannot be activated, won't show the url when hovered, but can be dragged (therefore identifying itself as a link). So they solve the question by preventing it from being asked. Clever. Konqueror behaves like NN4 (but renders differently). We could borrow the idea from Mozilla.
I can't reproduce this bug with svn trunk r793457.
Works with 3.5.9 as well.