331021 - Javascript bookmarklet causes blank document; code goes into address bar

Status: RESOLVED INVALID

(Firefox :: Bookmarks & History, defect)

Description

[timhopes92345]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

Here is the bookmarklet:

javascript:var allLinks=document.getElementsByTagName("a"); if (allLinks.length>0) allLinks[0].innerHTML="";

The bookmarklet is run, and if there is a link on the page, the document becomes empty, and the bookmarklet code replaces the current URL in the address bar.

Reproducible: Always

Steps to Reproduce:
1. Create bookmarklet
2. Go to page with link in it
3. Click on bookmarklet

Actual Results:  
The document becomes empty, and the bookmarklet code replaces the current URL in the address bar.

Expected Results:  
The innerHTML of the first link on the page should have been replaced with an empty string, and that is all.

Comment 1

[Uriah Narmed]

allLinks[0].innerHTML=""; returns an empty string, and when a value is returned from javascript:, the current page is replaced with that value. See http://subsimple.com/bookmarklets/rules.asp#ReturnValues for an explanation.

Recommend INVALID.

Comment 2

[Jesse Ruderman]

If the last statement in a javascript: URL evaluates to something other than "undefined", it is treated as HTML.  That is the behavior of javascript: URLs in most browsers (Safari may be an exception).

I agree that it's a strange behavior.  It confuses most bookmarklet authors at least once, and it was partially responsible for at least one security hole shared between IE and Firefox (bug 88167).  But removing it would probably break a lot of things.  (Safari seems to have gotten away with not implementing it, so maybe it doesn't break as many things as I'd think.)

I know of several ways to work around it:

* Add "void 0;" to the end.  This method is pretty clear.
* Add "[].v" to the end.  This method is the shortest I know of.
* Surround the last statement with "void()".  I don't like this method.
* Surround the bookmarklet with "(function(){ ... })();".  This method provides a scope for variables so they don't conflict with page variables, in addition to ensuring that the last statement evaluates to "undefined".

Comment 3

[Brendan Eich [:brendan]]

This goes back over ten years to Netscape 2 betas, and earlier even (I invented javascript: URLs in summer 1995 at Netscape, while cooking up JavaScript, _nee_ Mocha).  It's intended behavior, because bookmarklets are *not* the original use case of javascript: URLs -- generated documents and images were the first intended use-case.

Safari is broken.

/be