303728 - cbsnews.com - A link with onclick="check(" is processed while loading this site

Status: RESOLVED INCOMPLETE

(Tech Evangelism Graveyard :: English US, defect)

Description

[Brendan Eich [:brendan]]

Resulting in JS console traffic about the failure to compile the handler body.

This is a spin-off bug from bug 303163.  I'm starting it out in evangelism, but
it could be a bug in Gecko's DOM implementation that results in a malformed
onclick attribute value, where other browsers compute no such result.  It could
even be the case that other browsers compute such a result, but do not compile
it when a script then gets the value of the onclick property.

Our manic recompilation of event handler attribute values should be filed as a
separate Core / DOM level 0 bug, if it's not on file already.

/be

Comment 1

[Bob Clary [:bc] (inactive)]

from bug 303163 comment 27

<http://www.cbsnews.com/common/js/nav.js>
We take the else branch in function makeHome() which document.writes a link with 
 onclick="check(\"other\");" 
The escaping works in JS, but not when it is parsed as HTML. They don't make the
same mistake on the IE or NS branches.

Comment 2

[Bob Clary [:bc] (inactive)]

contacted via their web form.

Comment 3

[Chris Lawson (gone)]

INCOMPLETE due to lack of activity since the end of 2009.

If someone is willing to investigate the issues raised in this bug to determine whether they still exist, *and* work with the site in question to fix any existing issues, please feel free to re-open and assign to yourself.

Sorry for the bugspam; filter on "NO MORE PRE-2010 TE BUGS" to remove.