649818 - String.prototype.link does not html escape its parameter(s)

Status: RESOLVED DUPLICATE of bug 352437

(Core :: JavaScript Engine, defect)

Description

[Johan Sundström]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Build Identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0

String.prototype.link takes a text/plain url and should produce a text/html representation of a link to that url. Spidermonkey treats the url as if it's already quoted as text/html, though, which is not correct.

Example: 'x'.link('javascript:alert("x")')
Produces: '<a href="javascript:alert("x")">x</a>' (which the HTML parser interprets as '<a x")"="" href="javascript:alert(">x</a>')

Correct result: '<a href="javascript:alert(&quot;x&quot;)">x</a>'

Minimal fix: replace all " with "&quot;", all & with "&amp;" and all "<" with "&lt;". This probably goes both for the "this" argument (the link text) and the url parameter (the href-attribute-to-be), but at least for the url.

Reproducible: Always

Steps to Reproduce:
1. Run the bookmarklet javascript:void(prompt('html:','<&"'.link('<&"')))
Actual Results:  
<a href="<&""><&"</a>

Expected Results:  
<a href="&lt;&amp;&quot;">&lt;&amp;&quot;</a>, or perhaps <a href="&lt;&amp;&quot;"><&"</a>, if the string itself is supposed to already be text/html.

This bug has probably been in there pretty much forever. Safari and IE9 have the same bug (IE generates an ALL UPPERCASE tag, though). Chrome produces '<a href="&lt;&&quot;"><&"</a>' which at least produces a functional link.

Comment 1

[Jeff Walden [:Waldo]]

Yeah, we really should fix it, but it's been low-priority compared to other bugfixing and feature work.