292839 - textarea innerHTML doesn't handle entity references well

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Yuh-Ruey Chen]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050502 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050502 Firefox/1.0+

Suppose a text node with value containing non-text PCDATA (e.g. 'some<br
/>markup') is appended to a textarea element.  Then, the text node's contents
are added unescaped/unencoded/unserialized (whatever it's called - the process
of converting '<' to '&lt;', etc.).

Also, the textarea element displays these contents "correctly" unescaped.  This
is probably the fallback behavior for invalid textarea contents.

Possible culprits:
- the act of appending the text node to the textarea
- textarea.innerHTML is incorrect (this seems unlikely)

Reproducible: Always

Steps to Reproduce:
1) var textnode = document.createTextNode('some<br />markup');
2) textarea.appendChild(textnode);
3) output textarea.innerHTML
Actual Results:  
some<br />markup

Expected Results:  
some&lt;br /&gt;markup

Comment 1

[Yuh-Ruey Chen]

Attachment: test case

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

The DOM looks correct. Note that the creating/appending a textnode should not
unescape any HTML entities. createTextNode is not an html parser. there's also
no invalid contents involved. (compare the content model created by
data:text/html,<textarea>&lt;br/&gt;</textarea> )

Sounds to me like innerHTML is broken.

Comment 3

[Boris Zbarsky [:bzbarsky]]

The real problem is in the innerHTML getter and setter for <textarea>... they
try to do the right thing without fully reimplementing the whack parsing that
happens for textareas, but there are corner cases like this it ends up getting
wrong.

I'm pretty sure we have a bug on this already.

Comment 4

[Yuh-Ruey Chen]

Dupe of bug 215228?

> The DOM looks correct. Note that the creating/appending a textnode should not
> unescape any HTML entities. createTextNode is not an html parser. there's also
> no invalid contents involved. (compare the content model created by
> data:text/html,<textarea>&lt;br/&gt;</textarea> )
> 
> Sounds to me like innerHTML is broken.

Out of curiosity, when exactly are HTML entities supposed to be escaped?

document.createTextNode or node.appendChild or innerHTML(In reply to comment #2)

Comment 5

[Boris Zbarsky [:bzbarsky]]

> Out of curiosity, when exactly are HTML entities supposed to be escaped?

In general, whenever the data will be parsed by an HTML parser.

Comment 6

[Yuh-Ruey Chen]

I think this got fixed when the fix for bug 152329 was checked in.