Infinite requests on background-image:expression() with IE

[zyrolasting]

I am adding a web application to a client's existing site, so I adopted some of the code of the firm that wrote it. Since I am not allowed to refactor the entire site, my Yii instance simply runs on a subdomain and uses the same theme elements of the original site (images, CSS, etc). I cannot share much of the code since it is proprietary and I am under contract, but I can tell you as much as I can to reproduce the problem. Forgive me for any unanswered questions, as I am still learning the nature of the problem myself.

The site works fine in everything but IE. Not only do I encounter odd styling errors, the browser freezes after a few seconds while echoing "> where some images would be. To show you what I mean, I will link to two screenshots. The logo of the site has been blacked out in the normal shot (rendered in Chrome). Compare this to the other screenie, which has the bugged output underlined in red above a largely unstyled form. The cross you see is only but one image that is not related to the bug, although other images were superimposed on it.

I inspected the source of the bugged images and found that they had styles using expression() in their rules. All they do is take the innerHTML of the link the images are meant to go under and replace them with the markup of the image itself. Go figure.

/* MSIE PC */ #logo a {
background-image: expression(this.runtimeStyle.backgroundImage = "none", this.innerHTML = '<img src="images/justia-kleinmediation-com.gif" border="0" alt="' + this.innerHTML + '">');
}

#tagline a {
background-image: expression(this.runtimeStyle.backgroundImage = "none", this.innerHTML = '<img src="images/h2.gif" border="0" alt="' + this.innerHTML + '">');
}

Things get interesting when I notice that an entry in the runtime log shows the REQUEST_URI with the image name for expression()'d images as an action for the current controller.

2012/07/30 00:13:35 [error] [exception.CHttpException.404] exception 'CHttpException' with message 'The system is unable to find the requested action "images".' in C:\isd\prj\platform\xampp\htdocs\dectree\framework\web\CController.php:484
Stack trace:

0 C:\isd\prj\platform\xampp\htdocs\dectree\framework\web\CController.php(271): CController->missingAction('images')

1 C:\isd\prj\platform\xampp\htdocs\dectree\framework\web\CWebApplication.php(276): CController->run('images')

2 C:\isd\prj\platform\xampp\htdocs\dectree\framework\web\CWebApplication.php(135): CWebApplication->runController('user/images/jus...')

3 C:\isd\prj\platform\xampp\htdocs\dectree\framework\base\CApplication.php(162): CWebApplication->processRequest()

4 C:\isd\prj\platform\xampp\htdocs\dectree\index.php(14): CApplication->run()

5 {main}

REQUEST_URI=/user/images/justia-kleinmediation-com.gif
HTTP_REFERER=http://dectree.local/user/forgot

The logs quickly hit their max size and rotate until IE freezes and/or crashes, which suggests that the requests are made infinitely. This may be related to the echoed ">. To test this, I made the following change.

/* MSIE PC */ #logo a {
background-image: expression(this.runtimeStyle.backgroundImage = "none", alert(this.innerHTML));
}

The alert boxes never stopped. I also found out from the content of the boxes that this was their way of doing black hat keyword injections. Fun!

Other Details

I do not know why this is relevant, but this issue _ONLY occurs on IE, and ONLY when the page contains a CActiveForm_ (in my case). The expression()'d images do not wig out on pages with simple views with static content.

I will be talking to my client about removing the expression() rule, since I have never once seen that used and I doubt we even need it. I will inform you of any new information I come across.

[mdomba]

Please use the yii forum for similar issues

[zyrolasting]

I read your pinned post on the Yii forum about reporting bugs before opening this issue. Please make a clearer distinction between forum appropriate topics and GitHub appropriate topics.

Content has been copied.

[mdomba]

Well the main difference is not if it's a bug, but if it's a bug in the Yii core.

As it's written on this post - http://www.yiiframework.com/forum/index.php/topic/272-how-to-report-a-bug/

If you are sure that you have found a bug in Yii, you can open a new issue on GitHub to report it.
If you are not sure what you found is a bug, please discuss it on this board.

From your post it's not clear what your problem or bug can be at all... and without any code to check it's difficult to say would could be the problem... that's why I'm referring you to the Yii forum...

[zyrolasting]

Okay, it has been posted. I was confused by the wording, since I am sure I found a bug. I appreciate your time.

[mdomba]

Thank you for understanding... It still can be a bug... but from your post it's not really clear... as it can be a bug in custom code not in Yii core code.