Closed
Bug 552137
Opened 15 years ago
Closed 15 years ago
[HTML5] Normal characters dropped in innerHTML setter when surrounded by U+0000
Categories
(Core :: DOM: HTML Parser, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 566280
People
(Reporter: sroussey, Unassigned)
Details
Attachments
(1 file)
|
1.21 KB,
text/html;charset=iso-8859-1
|
Details |
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
Build Identifier:
When parsing, a text nodes starting with a null character will have them removed.
Reproducible: Always
Steps to Reproduce:
In an empty doc like <html><body></body></html> try this:
document.body.innerHTML="\0asdf\0"
results in:
document.body.textContent.length == 5
while
document.body.textContent="\0asdf\0"
results in:
document.body.textContent.length == 6
Firebug bug reference: http://code.google.com/p/fbug/issues/detail?id=2917
|
||
Comment 1•15 years ago
|
||
With which parser? If it's only happening with the non-HTML5 parser, I don't think we care...
|
|
||
Updated•15 years ago
|
Component: General → HTML: Parser
QA Contact: general → parser
Summary: Text Node can't start with null → Text Node can't start with null when parsed as part of innerHTML
|
Reporter | |
Comment 2•15 years ago
|
||
I haven't done anything to enable the HTML5 parser, and Firebug certainly isn't running using it, as far as I know.
Component: HTML: Parser → General
|
|
Reporter | |
Comment 3•15 years ago
|
||
For the HTML5 parser:
document.body.innerHTML="\0asdf\0"
results in:
document.body.textContent.length == 2
which is worse...
|
||
Updated•15 years ago
|
Component: General → HTML: Parser
|
||
Comment 4•15 years ago
|
||
Check results by attached simple HTML and script, to see rendering result and escaped content value. Following is obj.textContent.length, escape(obj.textContent), escape(obj.innerHTML) values.
HTML5 is disabled.
innerHTML="\0asdf\0"
=> 5 / asdf%uFFFD / asdf%uFFFD
textContent="\0asdf\0"
=> 6 / %00asdf%00 / %00asdf%00
HTML5 is enabled.
innerHTML="\0asdf\0"
=> 2 / %uFFFD%uFFFD / %uFFFD%uFFFD
textContent="\0asdf\0"
=> 6 / %00asdf%00 / %00asdf%00
HTML5 is disabled:
Parser looks to discard first 0x00, replace last 0x00 by U+FFFD.
HTML5 is enabled:
Parser replaces 0x00+asd by U+FFFD and f+0x00 by U+FFFD?
What is correct handling of 0x00 in HTML source?
If a script uses obj.innerHTML to put special binary like "\0" in a text node, I think it can be said wrong use or misuse of DOM property by the script.
|
|
||
Updated•15 years ago
|
Attachment #432503 -
Attachment mime type: text/html → text/html;charset=iso-8859-1
|
||
Comment 5•15 years ago
|
||
(In reply to comment #4)
> HTML5 is enabled:
> Parser replaces 0x00+asd by U+FFFD and f+0x00 by U+FFFD?
That's odd.
> What is correct handling of 0x00 in HTML source?
The correct handling per HTML5 is replacing U+0000 with U+FFFD.
The rationale is defense in depth. If the HTML5 dropped \0 but black-listing naive intermediate security enforcers didn't, an attacker could insert \0 to bypass blacklists. (Whitelists would be better of course, hence defense in depth as opposed to just defense.)
See also http://www.w3.org/Bugs/Public/show_bug.cgi?id=9096
|
|
Reporter | |
Comment 6•15 years ago
|
||
So is there a way in html to display the code marker for \u0000 the way we can in JS via document.body.textContent="\0" ?
|
|
||
Comment 7•15 years ago
|
||
(In reply to comment #6)
<p>�asdf�</p> == <p>�asdf�</p>
== obj.textContent="\0asdf\0";, if HTML5 is disabled.
If HTML5 is enabled, � / � was converted to U+FFFD.
Escaped values: (checked with Fx 3.6.0 on MS Win-XP SP3)
HTML5 is disabled : 6 / %00asdf%00 / %00asdf%00
HTML5 is enabled : 6 / %uFFFDasdf%uFFFD / %uFFFDasdf%uFFFD
|
|
||
Updated•15 years ago
|
Status: UNCONFIRMED → NEW
Ever confirmed: true
Summary: Text Node can't start with null when parsed as part of innerHTML → [HTML5] Normal characters dropped in innerHTML setter when surrounded by U+0000
|
|
||
Comment 8•15 years ago
|
||
Duplicating forward, because the newer bug has a fix.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → DUPLICATE
|
|
||
Comment 9•15 years ago
|
||
> So is there a way in html to display the code marker for \u0000 the way we can
> in JS via document.body.textContent="\0" ?
No. Why would you need it?
You need to log in
before you can comment on or make changes to this bug.
Description
•