204533 - JavaScript open() doesn't use & to delimit params

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[Tim Shadel]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030408
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030408

The open() function doesn't recognize URLs that have the & separator for
parameters required for XHTML, but the browser does.  The JavaScript interpreter
changes the "name" parameter to "amp;name" in the <script/> below.

Relevant URLs:

http://www.w3.org/TR/xhtml1/#C_12
http://marc.theaimsgroup.com/?l=struts-dev&m=105217326704654&w=2


HTML snippets:

<a href="/test.jsp?addr=nowhere&amp;name=bob">link OK</a>

                <script language="Javascript">
                    <!--
                    function MsgWindowBroken()
                    {
                            newWindow =
open("/test.jsp?addr=nowhere&amp;name=bob","MyTest","width=480,height=380,scrollbars=1,resizable=1,location=0");
                    }
                    document.write ('<a href="javascript:MsgWindowBroken();">js
broken</a>');
                    //-->
                </script>

Reproducible: Always

Steps to Reproduce:
1. Create an HTML file with the <script/> snippet above.
2. Click on the JavaScript link.

Actual Results:  
The parameter names weren't sent correctly.  The "name" param was sent as "amp;name"

Expected Results:  
The JS engine should have decoded the &amp; and created the URL
http://localhost/test.jsp?addr=nowhere&name=bob

Comment 1

[Boris Zbarsky [:bzbarsky]]

If the page is served as text/html, so we treat is as HTML (see
http://www.hixie.ch/advocacy/xhtml for a good summary of the reasons).  In HTML,
scripts are PCDATA and so & is _NOT_ converted to '&' in script data. 
Attributes are CDATA, so & is converted to '&'.

Now in XHTML (served as XML), scripts are CDATA, so the conversion should happen
-- one of the areas where XHTML is incompatible with HTML.  Since you're citing
the XHTML compatibility guidelines, I assume you read
http://www.w3.org/TR/xhtml1/#C_4 -- the example script in this bug MUST be
external for an XHTML document containing it to be labeled as text/html, due to
the above incompatibility.