(Un)quoting fails with many levels
Categories
(Core :: DOM: HTML Parser, defect)
Tracking
()
People
(Reporter: dpa-mozilla, Unassigned)
Details
Attachments
(1 file)
|
259 bytes,
text/html
|
Details |
User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0
Steps to reproduce:
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
</head><body>
<button onclick='window.confirm("A&B&qout;C'D")'>E</button>
<button onclick="window.confirm('F&G&qout;H'I')">J</button>
</body></html>
Actual results:
The first window.confirm() emits «A&B&qout;C'D»
The second window.confirm() is syntactically incorrect.
Expected results:
The first window.confirm() shall display «A&B"C'D» (without &qout;).
The second window.confirm() shall be syntactically correct.
|
Reporter | |
Comment 1•3 years ago
|
||
The original second window.confirm above contains H ampersand apos I, but it is rendered as H'I .
|
|
Reporter | |
Comment 2•3 years ago
|
||
I realized that I was using qOUt instead of qUOt . If I take " then both lines consistently fail.
See also the same problem for Chromium at https://bugs.chromium.org/p/chromium/issues/detail?id=1183132 and WebKit at https://bugs.webkit.org/show_bug.cgi?id=222528 .
I created file for tests: https://mail.aegee.org/t-quoting.html .
|
||
Updated•3 years ago
|
|
||
Comment 3•3 years ago
|
||
If it fails in all browsers the problem is likely on your end. I recommend reaching out to Stack Overflow or some such. (Hint: to escape something in JavaScript, use a backslash.)
Description
•