Bug triggered by files with space in the filename

I've encountered a bug which is triggered when a file is processed that has a space in the filename. The bug results in the code not being updated correctly and broken image references or document links as a result.

The problem is in the _filefield_paths_replace_path function and is happening because of a difference in the way the parse_url() and file_create_url() functions treat html entities.

Here is the code in question:

// Build regular expression.
$info = parse_url($old);
$info['path'] = !empty($info['path']) ? $info['path'] : '';
$absolute = str_replace("{$info['host']}{$info['path']}", '', file_create_url($old));

The URL that is returned by the call to file_create_url() has spaces replaced with their html entity - %20. However, parse_url simply returns the URL components and doesn't sanitize html entities.

As a result the str_replace call to create the absolute path doesn't replace the string correctly and so the rest of the replacement is affected with the result being incorrect paths in the resulting html.

The temporary fix I put in place was to modify the above code as follows:

// Build regular expression.
$info = parse_url($old);
$info['path'] = !empty($info['path']) ? $info['path'] : '';

// TEMP FIX TO CORRECT THE SPACE IN FILENAME BUG
$info['host'] = str_replace(' ', '%20', $info['host']);
$info['path'] = str_replace(' ', '%20', $info['path']);

$absolute = str_replace("{$info['host']}{$info['path']}", '', file_create_url($old));

I would think that the correct way to handle this is to have the parse_url modified such that it can optionally translate HTML entities if that is the desired result, and to have the file_create_url method modified such that it can optionally not translate HTML entities.

However, in the interest of getting this fixed as soon as possible for anyone using this module I am filing this here. I am also going to file this as a bug report with Drupal core.

Thanks,
Pablo