Closed Bug 1547882 Opened 1 year ago Closed 1 year ago

Some characters are incorrectly escaped in the query part of web-extension URLs


(Core :: Networking, defect, P2)

66 Branch



Tracking Status
firefox68 --- fixed


(Reporter: andro.marian.v94, Assigned: valentin)


(Blocks 1 open bug)


(Whiteboard: [necko-triaged])


(2 files)

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0

Steps to reproduce:

let page = chrome.runtime.getURL("page.html");
page += "&u="+ encodeURIComponent("");

chrome.tabs.update(id, { url: page });

Actual results:

Why is decode the url parameter ?

Is: https%3A//

This is not happend in Google Chrome.

Summary: browser.tabs.update is decoding the encodeURLComponents → browser.tabs.update is decoding the encodeURIComponent
Summary: browser.tabs.update is decoding the encodeURIComponent → the encodeURIComponent is decoding when clicking or updative the url

Hi @Andronachi Marian, first we need some clarifications:

  1. The encodeURIComponent() function encodes a Uniform Resource Identifier (URI) component by replacing each instance of certain characters by one, two, three, or four escape sequences representing the UTF-8 encoding of the character (will only be four escape sequences for characters composed of two "surrogate" characters).
  2. You provide a URL at steps to reproduce and on at "Actual results" there are two URL encoded. Those are the results after invoking the URL ?
  3. I've tried the link provided at steps to reproduce in: => pressing the "Encode" button the results was ( and pressing the "Decode" button was (
  4. So, what is your error?
  5. Please make the things clear and let me known after. Thanks for your contribution.
Component: Untriaged → Networking: HTTP
Flags: needinfo?(andro.marian.v94)
Product: Firefox → Core

When you pass an EncodedURL to chrome.tabs.update(); or maybe when pressing a URL. The URL in the TAB_BAR will decode automatically all characters %2F to /. How the first post is From -> To.

Why the TAB_BAR URL is decoding automatically the %2F to / ?

Flags: needinfo?(andro.marian.v94)

Can you provide some clear steps to reproduce that actually work in Firefox?

chrome.runtime.getURL is not something that works when I paste it into the devtools console.
Is this for an addon?

Please be very clear and explicit with every step we need to take to reproduce the bug.

Flags: needinfo?(andro.marian.v94)

Yes is from addon.

Flags: needinfo?(andro.marian.v94)

In that case moving to the Webextensions component. I hope they have enough info to reproduce.

Component: Networking: HTTP → Untriaged
Product: Core → WebExtensions

We decode some characters for readability when we display URLs in the location bar, but underneath we still load them fully encoded.

Closed: 1 year ago
Resolution: --- → INVALID

Is not only in the location bar. If i say in DevTools "window.location.href". It's decoded.
Yes is a good idea. But its change the URL from window.location.href. In this case is not a good idea.

If i want to compare a URL and a cache URL i cant because is different from the first time.

(In reply to Andronachi Marian from comment #8)

Is not only in the location bar. If i say in DevTools "window.location.href". It's decoded.

Huh. That's interesting. I don't know what layer that's happening in, then. We pass the URL with entities intact to linkedBrowser.loadURI.

Component: Untriaged → Document Navigation
Ever confirmed: true
Product: WebExtensions → Core
Resolution: INVALID → ---

I contacted the reporter and I think I finally figured out what the problem is.

Either drag a bookmark into the URL bar, or drag one of the top sites from the about:newtab page into the URL bar.
The extension will take you to something that looks like: moz-extension://a7d1572e-3beb-4d93-a920-c408fa09e8ea/_source/holding.html?
You'll notice that the u= has unescaped slashes

This can be more easily reproduced as:

var url = new URL("moz-extension://a7d1572e-3beb-4d93-a920-c408fa09e8ea/_source/holding.html?");
console.log(url.href); // moz-extension://a7d1572e-3beb-4d93-a920-c408fa09e8ea/_source/holding.html?u=https%3A//

// but you can do this:"";
console.log(url.href); // moz-extension://a7d1572e-3beb-4d93-a920-c408fa09e8ea/_source/holding.html?
Assignee: nobody → valentin.gosu
Component: Document Navigation → Networking
Priority: -- → P2
Whiteboard: [necko-triaged]
Blocks: url
Summary: the encodeURIComponent is decoding when clicking or updative the url → Some characters are incorrectly escaped in the query part of web-extension URLs

Since the SubstitutingProtocolHandler is also extended by nsResProtocolHandler, this change would also apply to resource:// URLs.

Pushed by
Don't unescape %2e and %2f in the query or hash or moz-extension URLs. r=kershaw
Fix test_bug337744.js that expects no %2f in the query of resource URLs r=kmag,kershaw
Closed: 1 year ago1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
You need to log in before you can comment on or make changes to this bug.