610219 - if a hash with #"> or #%22%3E is put into a link using .innerHTML link is not parsed correctly

Status: RESOLVED DUPLICATE of bug 483304

(Core :: DOM: Core & HTML, defect)

Description

[m]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; af; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; af; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729)

when http://www.example.com#%22%3E (or any hash with %22 and %3E) is entered and a link is created from the hash it is not parsed correctly. Please see steps to reproduce:

Works in all other browsers (Chrome,Opera,Safari and IE)

Reproducible: Always

Steps to Reproduce:
1. Run the following:
<div id="a"></div>

<script>
document.getElementById("a").innerHTML="<a href=\""+document.location.hash+"\">"+document.location.href+"</a>";
</script>
2. Enter the hash as #"> or #%22%3E
3. The generated link is malformed and does not go to #%22%3E
Actual Results:  
Link:

">http://www.example.com#%22%3E

goes to:

http://www.example.com#

Expected Results:  
link should be:

http://www.example.com#%22%3E

should go to

http://www.example.com#%22%3E

Comment 1

[Matthias Versen [:Matti]]

http://tools.ietf.org/html/rfc2616#section-3.2.2
>If the abs_path is not present in the URL, it MUST be given as "/" when used as a Request-URI for a resource

http://tools.ietf.org/html/rfc2396#section-4
# is used for URL fragments

You have an absolute URL without a absolute Path (no "/") and a URL fragment.
>goes to:
>http://www.example.com#

As link the URL bar shows http://www.example.com/#"> which seems correct to me.
your hash is used as fragment and the escaped chars are unescaped.

Is this report only about the Firefox URL bar which does it's own URL fixing and where you filed this report or for Gecko/Networking which would be the case for all URLs inside documents as link or for the DOM ?

Comment 2

[m]

Sorry I wasn't really clear previously.

I realized that this not a bug in particular. The different behaviour in the other browsers threw me off.

When creating a link using .innerHTML and the href property is set to document.location.hash the %22%3E is unescaped and as a result closes the link as <a href="#">">

In other browsers the document.location.hash is returned as it was entered in the URL, while in Firefox it is unescaped and this is shown in the URL bar and returned by the javascript. 

So as I experienced document.location.hash in other browsers (Opera,Chrome,Safari,IE) returns the URL as entered and is not unescaped in the URL bar.
http://www.example.com/#%22%3E

While Firefox unescapes in both document.location.hash and the URL bar.
http://www.example.com/#"> which caused my "error" because i did not handle it correctly.

Sorry for wasting your time and thanks for this great browser :)

Comment 3

[Daniel.S]

This is actually known as bug 483304.