310714 - application/ecmascript with undefined parameters shoud be ignored

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[nanto_vi (TOYAMA Nao)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP; rv:1.7.12) Gecko/20050919 Firefox/1.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20051001 Firefox/1.4.1

"Scripting Media Types" [1] expects "stricter proccessing rules" for the media
type application/ecmascript.  So we shouldn't execute scripts whose media type
is application/ecmascript and has any parameters except charset.

[1] http://www.ietf.org/internet-drafts/draft-hoehrmann-script-types-03.txt

Reproducible: Always

Steps to Reproduce:
1. View the following HTML:
<script type="application/ecmascript; undefined=parameter">
alert("Hello.");
</script>
Actual Results:  
An alert dialog appears.

Expected Results:  
Nothing happens.

Comment 1

[nanto_vi (TOYAMA Nao)]

Attachment: test case

Comment 2

[Boris Zbarsky [:bzbarsky]]

Confirming.  Brendan, jst, what do we want to be doing here?

I think we should resolve this one way or another for 1.8...

Comment 3

[Brendan Eich [:brendan]]

Reading the internet-draft again, it's clear that only version, not any
undefined parameter, may cause the UA to ignore the script tag.  Cc'ing B.
Hoehrmann for confirmation.  This bug is probably INVALID.

/be

Comment 4

[Boris Zbarsky [:bzbarsky]]

Bjoern, could you comment on what the draft says please?

Comment 5

[Bjoern Hoehrmann]

I note that W3C's HTML and XHTML specification are unclear about whether type attributes allow media type parameters and what the processing model might be if they do, so the test case is, as far as spec-compliance is concerned, bogus.

As for the draft, implementers are required to consider the impact of new parameters (you do have to think about it)! But no specific behavior for unknown parameters is required. Rejecting such content is just as valid as ignoring the parameter, asking the user whether they would like to run the script, writing a warning to some error console, or you could ignore any unknown parameter that starts with "x-" and fail for all others, and so on.

So yes, as far as compliance to the draft is concerned, behavior is up to
the implementation and the bug could be considered invalid.