1066001 - Network tab doesn't escape HTML in JSON responses

Status: RESOLVED WORKSFORME

(DevTools :: Netmonitor, defect, P3)

Description

[Josh Tumath]

1. Open a page that receives a JSON response with HTML in it
2. Click on that response
3. Click on the preview tab

All of the HTML is interpreted, which can lead to some interesting results.

Comment 1

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Thanks for the report!

Honza

Comment 2

[Vincent Lequertier]

Hi,

Can I work on this? :-)

Vincent

Comment 3

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Sure!

Assigned to you. I am not sure if this is still a problem (there is no test case I could try) so, it would be nice if we can get one first.

Honza

Comment 4

[Vincent Lequertier]

I can reproduce the issue :

If a webserver is configured to send a Content-Type text/html for a json file, the content of the json file is interpreted as html in the preview tab. But this is the correct behavior, right ? Reporter, is that what you mean?

If a webserver sends a json response with the Content-Type application/json, then there is no preview tab and nothing is interpreted.

Comment 5

[Vincent Lequertier]

Attachment: A script to create a php webserver with content-type text/html for all requests

This a script to reproduce the issue:

run it with:

php -S 127.0.0.1:8080 -file test.php

then put this json in same directory as the script:

{"test":"<em>test</em"}

And point firefox to localhost:8080/test.json

test is in italic.

Comment 6

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Thanks, the test case works for me.

Just a small typo, content of the JSON file should be (see the closing tag):

{"test":"<em>test</em>"}

Now, how do you want to fix this?

Honza

Comment 7

[Vincent Lequertier]

I'm not sure if this is really a bug. If the content type is text/html, it seems logical to me that firefox interpret the file as html. Is this the expected behavior?

Comment 8

[Luna Phipps-Costin]

Firefox appropriately looks at the MIMEtype of the document. In your example, the PHP server returns a `text/html` header when it is not html. Because of that, FF shows a preview pane. When the proper header `text/txt` or `text/json` is returned, firefox will not show a preview. I think this is a WORKSFORME.

Comment 9

[Vincent Lequertier]

I wasn't sure. Thanks for taking a look!