29284 - Unescaped javascript URL corrupts localstore.rdf

Status: VERIFIED FIXED

(Core Graveyard :: RDF, defect, P2)

Description

[Simon Fraser [no longer active]]

Somehow, I ended up with this line in my localstore.rdf:

  <RDF:Description about="javascript:if(sint0002 = prompt('Bug Number:','')) 
location.href="http://bugzilla.mozilla.org/show_bug.cgi?id=" + sint0002;">
    <open>true</open>
  </RDF:Description>

It seems that the URL needs to be escaped, to encode the quotes.

Comment 1

[Simon Fraser [no longer active]]

Attachment: localstore.rdf file

Comment 2

[Simon Fraser [no longer active]]

This bug causes bad things to happen on startup for me.

Comment 3

[Chris Waterson]

I need to use the nsURLEscape code. I think what I have in there is home-grown 
right now. Thanks for wiping my chin, sfraser.

Comment 4

[Paul MacQuiddy]

I'm having some type of problem where my localstore.rdf is not being read in (at
least correctly) or saved at exit. Seems to be creating it on the fly everytime.
I'm not as smart as simon, so I can't tell what the problem is. If I rename the
file, then things work swell again.

This is probably a completely different bug, let me know.

I'll attach the file that hosed me.

Comment 5

[Paul MacQuiddy]

Attachment: bad localstore.rdf file (win98) using beta1 branch bits

Comment 6

[Chris Waterson]

fixed

Comment 7

[Tom Everingham]

verified