Applet/Object param values get truncated if containing '&lt;' '&gt;' '<' or '>'

RESOLVED INVALID

Status

()

Core
Plug-ins
P2
normal
RESOLVED INVALID
16 years ago
5 years ago

People

(Reporter: Ingrid, Assigned: Peter Lubczynski)

Tracking

Trunk
mozilla1.4alpha
x86
Windows XP
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [PL2:NA])

(Reporter)

Description

16 years ago
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0rc2)
Gecko/20020510
BuildID:    2002051006

If an applet/Object parameter value contains a quoted or unquoted '<' '>' the
value gets truncated, so that the applet receives a wrong string, which will
hinder the applet from correct behavior.
Especially if '>' is contained, the following params are not recognized as
params anymore but shown as text in the html page instead.

Example:
------------------------------------------------------------------
HTML part generated from a JSP:
...
<object classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93" width="457" 
height="31" 
codebase="http://java.sun.com/products/plugin/1.2.2/jinstall-1_2_2-win.cab#Version=1,2,2,0">
	<param name="java_code" value=" ... myCode ...">
	<param name="java_codebase" value=" ... myCodebase ...">

	<param name="TEST_TEST" value="< blabla >">

	<COMMENT>
	<embed type="application/x-java-applet;version=1.1"  width="457"  height="31"
pluginspage="http://java.sun.com/products/plugin/" java_code=" ... myCode ..."
java_codebase=" ... myCodebase ..." archive=myApplet.jar
	 ... 
	TEST_TEST=< blabla >
	>
	<noembed>
	</COMMENT>
	</noembed></embed>
</object>
...
>>>---------------------------------------------------->>>>
what the applet gets in different cases:

having <param name="TEST_TEST" value="< blabla >"> we get
--> Netscape 6.2:	getParameter("TEST_TEST") == "< blabla >"
--> Mozilla1 RC2:	getParameter("TEST_TEST") == "<"

having <param name="TEST_TEST" value="blabla &gt; &lt;"> we get
--> Netscape 6.2:	getParameter("TEST_TEST") == "blabla > <"
--> Mozilla1 RC2:	getParameter("TEST_TEST") == "blabla"

having <param name="TEST_TEST" value="&lt; blabla &gt;"> we get
--> Netscape 6.2:	getParameter("TEST_TEST") == "< blabla >"
--> Mozilla1 RC2:	getParameter("TEST_TEST") == "<"

------------------------------------------------------------------
Reproducible: Always
Steps to Reproduce: see code examples in description above
Actual Results:  Parameter values become truncated.
Expected Results:  Parameter values should not become truncated.
I assume that by
    having <param name="TEST_TEST" value="< blabla >">
you mean
    having <param name="TEST_TEST" value="< blabla >">
    and <embed ... TEST_TEST=< blabla > >
and so forth for the other examples? A plausible explanation I see would be that
n62 is ignoring the TEST_TEST attribute of the <embed> tag and thus gets the
value you want from the properly quoted 'value'-attribute value of the <param> tag.

m1rc2 would then also see the <embed ...> part, so the result of
    TEST_TEST=< blabla >
is equivalent to
    TEST_TEST="<" foo bar
; similarly:
    TEST_TEST=blabla &gt; &lt;
->  TEST_TEST="blabla" foo bar
and
    TEST_TEST=&lt; blabla &gt;
->  TEST_TEST="&lt;" foo bar

...so the results look pretty much correct to me. Anyway, I'm pretty much
guessing here but I figure quoting the TEST_TEST attribute value in the <embed>
tag would solve the problem.
(Reporter)

Comment 2

16 years ago
Yes you are completely right. Quoting the TEST_TEST attribute value in the
<embed> tag solves the problem.

So this might be more an error of the JSP engine which generates the unquoted
attribute values in the embed tag.

What I still did not quite understand is, why Mozilla ignores the object tag and
parses the embed tag whereas Netscape6.2 ignores the embed tag. For both I have
the Java Plug-in 1.3.1_03 for Netscape Navigator installed.
->Plug-ins, no longer a parser problem
Assignee: harishd → beppe
Component: Parser → Plug-ins
QA Contact: moied → shrir

Comment 4

15 years ago
Values within the attribute value should not be altered, rather they should just
be passed. Assigning this to Serge, adding AV. This is actually quite important
to resolve quickly
Assignee: beppe → serge
Status: UNCONFIRMED → NEW
Ever confirmed: true
Priority: -- → P2
Whiteboard: [PL2:NA]
Target Milestone: --- → mozilla1.3alpha

Comment 5

15 years ago
peterl 
Assignee: serge → peterl
Target Milestone: mozilla1.3alpha → mozilla1.4alpha
QA Contact: shrir → plugins

Comment 6

5 years ago
HTML parsing is correct, the bug is in the website. Why it took 11 years to figure this out is a mystery of life, I guess.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.