187441 - URLs not HTML encoded in output

Status: VERIFIED FIXED

(Webtools Graveyard :: Web Sniffer, defect)

Description

[Tom Gilder]

User-Agent:       Opera/7.0 (Windows 98; U)  [en]
Build Identifier: 

When loading a page into the sniffer that has URLs in the source, you can insert 
any HTML using something like <a 
href="http://><script>alert('boo')</script>">test</a>. See URL for working 
example. Special characters just need to be replaced with HTML entities. This is 
not the same as bug 57556.


Reproducible: Always

Steps to Reproduce:

Comment 1

[Dave Miller [:justdave]]

Nothing seems to happen when I view the attached URL, I get four horizontal bars
and the word "succeeded" twice, and that's it.  View source doesn't show me
anything additional to that was sent.

If I try to view the referenced URL within the attached one, I get an alert from
Mozilla stating 'The site "><script>alert('boo')</script>" could not be found'.

Comment 2

[Dave Miller [:justdave]]

ok, did it again and it worked this time.  Don't know why it didn't the first
time...

Anyone know who's in charge of web-sniffer?  default assignee is "nobody" which
isn't real promising...

Comment 3

[timeless]

someone needs to recompile websniffer.

Comment 4

[Dave Miller [:justdave]]

OK, websniffer has been cvs updated and recompiled on webtools.mozilla.org
(lounge).  Tom: can you verify if it's fixed?

Comment 5

[Tom Gilder]

Confirmed fixed. Very efficient :)

Comment 6

[Dave Miller [:justdave]]

verified fixed per comment 5