2069873 - Overeager visual URL-decoding of delimiters in multiple components: link previews, devtools

Status: UNCONFIRMED

(DevTools :: General, defect, P3)

Description

[Uku Sõrmus]

Steps to reproduce:

1. Take the following example links:
   1.1. https://example.com/?action=edit&username=%26action%3Ddelete
   1.2. https://example.com/X%23Y
   1.3. https://example.com/X%2FY%3FZ

2. Observe over-eager visual URL-decoding, when:
   2.1. Hovering over the links above, checking the URL preview in the bottom of the desktop browser
   2.2. Pasting any of the links into the address bar, checking the URL preview shown
   2.3. Opening devtools, navigating to any of the links, checking the
   2.3.1. "File" column
   2.3.2. The first row of "Headers"
   2.4. Opening devtools console while on example.com, executing fetch(<any of the URLs above>), checking the visual error message (in this case, 404)

Note not all the 2.X behaviors apply to all of the 1.X test cases.

Example: https://example.com/?action=edit&username=%26action%3Ddelete is displayed as https://example.com/?action=edit&username=&action=delete in all 2.X cases, changing the semantic meaning from two query parameters (action, username) to three query parameters (action, username, action).

Actual results:

URL-encoded URL (sub)delimiters are overeagerly URL-decoded in the visual output in multiple components like link previews and devtools.

Semantic meaning as seen by the end user or developer is different than the actual semantics of the URL.

The actual bytes sent to the server seem consistent with the actual meaning of the URL, so it seems to be only a visual bug.

Expected results:

URL-encoded URL (sub)delimiters (reserved characters), including %2F (/) , %3F (?), %26 (&), %23 (#), should not be visually URL-decoded.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'DevTools::General' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Nicolas Chevobbe [:nchevobbe]]

Let's have individual bugs for each of the components that are impacted

Comment 3

[Nicolas Chevobbe [:nchevobbe]]

(In reply to Nicolas Chevobbe [:nchevobbe] from comment #2)

Let's have individual bugs for each of the components that are impacted

Filed Bug 2069873 for link previews, let's have this one for DevTools

Comment 4

[Nicolas Chevobbe [:nchevobbe]]

Attachment: URL decoding in Netmonitor File cell and Headers collapsed URL

In the Netmonitor, we can see the URL-decoding in the "File" column (but interestingly, not in the URL one)
It's also visible in the headers panel, when the URL is not expanded (even though for the https://example.com/?action=edit&username=%26action%3Ddelete case, we can see that action isn't actually a param as it's not in blue, but that's way too subtle)
The URL in the console when enabling the "Requests" filer is also decoded (and shouldn't)