1430790 - encoded params in urls get decoded when displayed by firefox

Status: RESOLVED DUPLICATE of bug 1430796

(Firefox :: Untriaged, defect)

Description

[hardy.guinea.pig+github]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:57.0) Gecko/20100101 Firefox/57.0
Build ID: 20180103231032

Steps to reproduce:

Just create a page with links like this:

<a href="http://localhost?callback=http%3A%2F%2Fcall.back%2Fsomething%3Fa%3Db%26param1%3Dvalue1%26param2%3Dvalue2">Params in callback</a>
<br/>
<a href="http://localhost?callback=http%3A%2F%2Fcall.back%2Fsomething%3Fa%3Db&param1=value1&param2=value2">Params outside callback</a>

And open in firefox.

Add a url like this for even more confusion:
<a href="http://localhost?callback=http%3A%2F%2Fcall.back%2Fsomething%3Fa%3Db%26param1%3Dvalue1%26param2%3Dvalue2&param1=valueA&param2=valueB">Params in both</a>


Actual results:

If you mouse over the first and second links, firefox displays the same thing in the status bar:
https://www.local.bbc.com/?callback=http://call.back/something?a=b&param1=value1&param2=value2

The console displays the same link as well, both on the main network window and under console/Network/Headers/Request URL.

Because of this incorrect representation, we also have a mismatch with:
console/Network/Params, where correct params are displayed, therefore not matching the url.

The third url is even worse, we don't even know what param belongs to what, it becomes:
https://www.local.bbc.com/?callback=http://call.back/something?a=b&param1=value1&param2=value2&param1=valueA&param2=valueB


Expected results:

The url encoded params should not be decoded, it's very confusing and misleading for developers and users. 
It could also be used to confuse people and craft dodgy urls
First and second URLs are different urls, and should be represented as such.

- Headers URL: 
http://localhost?callback=http%3A%2F%2Fcall.back%2Fsomething%3Fa%3Db&param1=value1&param2=value2
- Params:
callback	http://call.back/something?a=b
param1	value1
param2	value2

- Header URL: 
https://www.local.bbc.com/?callback=http%3A%2F%2Fcall.back%2Fsomething%3Fa%3Db%26param1%3Dvalue1%26param2%3Dvalue2
- Params: 
callback	http://call.back/something?a=b&param1=value1&param2=value2

Third url simply doesn't make any sense and should be:

- Header URL: 
https://www.local.bbc.com/?callback=http%3A%2F%2Fcall.back%2Fsomething%3Fa%3Db%26param1%3Dvalue1%26param2%3Dvalue2&param1=valueA&param2=valueB
- Params: 
callback	http://call.back/something?a=b&param1=value1&param2=value2
param1	valueA
param2	valueB

Basically, do the same as Chrome

Comment 1

[Cristina Badescu [:cbadescu], Experiments QA]

Hello,

I'm going to close this issue since it seems to be a duplicate of: bug 1430796.