Last Comment Bug 309040 - Invalid html in form causes errors outside affected form tag.
: Invalid html in form causes errors outside affected form tag.
Status: RESOLVED FIXED
: fixed1.8, regression, testcase
Product: Core
Classification: Components
Component: HTML: Parser (show other bugs)
: Trunk
: All All
: -- normal (vote)
: ---
Assigned To: Blake Kaplan (:mrbkap) (please use needinfo!)
: Blake Kaplan (:mrbkap) (please use needinfo!)
Mentors:
Depends on:
Blocks: 285250
  Show dependency treegraph
 
Reported: 2005-09-18 06:23 PDT by pflodo
Modified: 2005-09-19 16:06 PDT (History)
3 users (show)
mtschrep: blocking1.8b5+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase of invalid text in <option> tag breaking form and following text (414 bytes, text/html)
2005-09-18 06:26 PDT, pflodo
no flags Details
Easy fix (1.76 KB, patch)
2005-09-18 11:14 PDT, Blake Kaplan (:mrbkap) (please use needinfo!)
jst: review+
jst: superreview+
mtschrep: approval1.8b5+
Details | Diff | Review

Description pflodo 2005-09-18 06:23:12 PDT
User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b4) Gecko/20050906 SUSE/1.4.99-1 Firefox/1.4
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b4) Gecko/20050906 SUSE/1.4.99-1 Firefox/1.4

I have found as part of a website admin screen (that I have used for years with
IE, Mozilla, Firefox) that 1.5 beta has an issue where due to invalid html.
There is an email address in the form DISPLAYNAME <EMAIL@SOMEWHERE> as text
inside the option tag. Firfox 1.5 beta 1 includes text from outside the form tag
in the text of the dropdown inside the form.

The page is not public so I have created a test file showing the error.

Reproducible: Always

Steps to Reproduce:
1. This is a display/behaviour problem, so just load the page.
Actual Results:  
The submit button and also text outside the form tag, is included inside the
dropdown.
The dropdown doesn't work.

Expected Results:  
The use of an email address enclosed in angled brackets inside the <option> tag
is not valid HTML, but all other browser fail this by not rendering the
resulting offending tag, and still leaving a functional dropdown and submit button.
Comment 1 pflodo 2005-09-18 06:26:01 PDT
Created attachment 196526 [details]
testcase of invalid text in <option> tag breaking form and following text
Comment 2 Joseph Wright 2005-09-18 06:33:41 PDT
See the same on Windows.  This is probably all, I guess.
Comment 3 Uri Bernstein (Google) 2005-09-18 06:37:16 PDT
Confirming on
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b4) Gecko/20050913
Firefox/1.4

Not seeing this in Firefox 1.0, so regression.
Can't find a duplicate, so confirming.
Comment 4 Uri Bernstein (Google) 2005-09-18 06:59:17 PDT
Regression window is between 2005-03-17-07 and 2005-03-18-07, suggesting one of
bug 160095, bug 285250, or bug 284587. 
Comment 5 Uri Bernstein (Google) 2005-09-18 07:52:40 PDT
Since this is a regression, and might affect other cases as well, nominating to
block 1.8b5.
Comment 6 Blake Kaplan (:mrbkap) (please use needinfo!) 2005-09-18 11:09:49 PDT
Bug 285250 takes the cake here. I'll attach a fix in a second.
Comment 7 Blake Kaplan (:mrbkap) (please use needinfo!) 2005-09-18 11:14:22 PDT
Created attachment 196572 [details] [diff] [review]
Easy fix

This is exactly the same problem as bug 287349, we need to exclude kHeadMisc
too. I don't think there are any more elements like this.
Comment 8 pflodo 2005-09-18 14:54:39 PDT
Damn you guys are good.
A late night submission has a patch by my morning.

MS can eat your dust....

Keep up the good work, you are making the world a better place, one line at the
time.
Comment 9 Johnny Stenback (:jst, jst@mozilla.com) 2005-09-19 11:58:33 PDT
Comment on attachment 196572 [details] [diff] [review]
Easy fix

r+sr=jst
Comment 10 Blake Kaplan (:mrbkap) (please use needinfo!) 2005-09-19 12:03:22 PDT
Fix checked into trunk.
Comment 11 Blake Kaplan (:mrbkap) (please use needinfo!) 2005-09-19 12:04:56 PDT
Comment on attachment 196572 [details] [diff] [review]
Easy fix

This is a very safe fix (it only affects userdefined tags inside of option
tags) that fixes a bug which could cause a page to be swallowed up by a
malformed option tag.
Comment 12 Mike Schroepfer 2005-09-19 15:18:10 PDT
Comment on attachment 196572 [details] [diff] [review]
Easy fix

Approved for 1.8b5 per bug meeting
Comment 13 Blake Kaplan (:mrbkap) (please use needinfo!) 2005-09-19 16:06:58 PDT
Fix checked into MOZILLA_1_8_BRANCH.

pflodo, thanks for making such a simple testcase. That really helped me come up
with the fix for this.

Note You need to log in before you can comment on or make changes to this bug.