22104 2008-11-06 10:04:15 -0800 Javascript URL percent encoding/decoding broken by some characters 2008-11-09 11:09:03 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED P2 Major --- 1 ap ap oldest_to_newest 97827 0 ap 2008-11-06 10:04:15 -0800 Steps to reproduce: 1) Open http://lleo.aha.ru/dnevnik/2008/10/13.html 2) Click on one of the blue asterisks in text (not the first one, though). Results: An alert appears. It contains many U+FFFD replacement characters. Works in Firefox. The code is: <a href='javascript:alert("<cyrillic letters>\n<more cyrillic letters>")'>*</a> Document charset is windows-1251. 98064 1 24999 ap 2008-11-09 04:54:58 -0800 Created attachment 24999 proposed fix 98068 2 24999 darin 2008-11-09 07:21:07 -0800 Comment on attachment 24999 proposed fix r=me 98084 3 ap 2008-11-09 11:09:03 -0800 Committed revision 38243. 24999 2008-11-09 04:54:58 -0800 2008-11-09 07:21:07 -0800 proposed fix JavaScriptURLEncoding.txt text/plain 3668 ap SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAzODI0MCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTQgQEAKKzIwMDgtMTEtMDkgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEB3ZWJr aXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjEwNAorICAgICAgICBK YXZhc2NyaXB0IFVSTCBwZXJjZW50IGVuY29kaW5nL2RlY29kaW5nIGJyb2tlbiBieSBzb21lIGNo YXJhY3RlcnMKKworICAgICAgICBUZXN0OiBmYXN0L2xvYWRlci9qYXZhc2NyaXB0LXVybC1lbmNv ZGluZy0yLmh0bWwKKworICAgICAgICAqIHBsYXRmb3JtL0tVUkwuY3BwOiAoV2ViQ29yZTo6ZW5j b2RlUmVsYXRpdmVTdHJpbmcpOiBEb24ndCB0cnkgdG8gYnJlYWsgZG93biBqYXZhc2NyaXB0IFVS THMuCisKIDIwMDgtMTEtMDggIEFudHRpIEtvaXZpc3RvICA8YW50dGlAYXBwbGUuY29tPgogCiAg ICAgICAgIFJldmlld2VkIGJ5IFNhbSBXZWluaWcuCkluZGV4OiBXZWJDb3JlL3BsYXRmb3JtL0tV UkwuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvcGxhdGZvcm0vS1VSTC5jcHAJKHJldmlzaW9u IDM4MjMyKQorKysgV2ViQ29yZS9wbGF0Zm9ybS9LVVJMLmNwcAkod29ya2luZyBjb3B5KQpAQCAt MTQ4MCw3ICsxNDgwLDcgQEAgc3RhdGljIHZvaWQgZW5jb2RlUmVsYXRpdmVTdHJpbmcoY29uc3Qg UwogICAgIFRleHRFbmNvZGluZyBwYXRoRW5jb2RpbmcoVVRGOEVuY29kaW5nKCkpOyAvLyBQYXRo IGlzIGFsd2F5cyBlbmNvZGVkIGFzIFVURi04OyBvdGhlciBwYXJ0cyBtYXkgZGVwZW5kIG9uIHRo ZSBzY2hlbWUuCiAKICAgICBpbnQgcGF0aEVuZCA9IC0xOwotICAgIGlmIChlbmNvZGluZyAhPSBw YXRoRW5jb2RpbmcgJiYgZW5jb2RpbmcuaXNWYWxpZCgpICYmICFwcm90b2NvbElzKHJlbCwgIm1h aWx0byIpICYmICFwcm90b2NvbElzKHJlbCwgImRhdGEiKSkgeworICAgIGlmIChlbmNvZGluZyAh PSBwYXRoRW5jb2RpbmcgJiYgZW5jb2RpbmcuaXNWYWxpZCgpICYmICFwcm90b2NvbElzKHJlbCwg Im1haWx0byIpICYmICFwcm90b2NvbElzKHJlbCwgImRhdGEiKSAmJiAhcHJvdG9jb2xJcyhyZWws ICJqYXZhc2NyaXB0IikpIHsKICAgICAgICAgLy8gRmluZCB0aGUgZmlyc3QgaW5zdGFuY2Ugb2Yg ZWl0aGVyICMgb3IgPywga2VlcCBwYXRoRW5kIGF0IC0xIG90aGVyd2lzZS4KICAgICAgICAgcGF0 aEVuZCA9IGZpbmRGaXJzdE9mKHMuZGF0YSgpLCBzLnNpemUoKSwgMCwgIiM/Iik7CiAgICAgfQpJ bmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0No YW5nZUxvZwkocmV2aXNpb24gMzgyNDApCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtp bmcgY29weSkKQEAgLTEsMyArMSwxMyBAQAorMjAwOC0xMS0wOSAgQWxleGV5IFByb3NrdXJ5YWtv diAgPGFwQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyMTA0 CisgICAgICAgIEphdmFzY3JpcHQgVVJMIHBlcmNlbnQgZW5jb2RpbmcvZGVjb2RpbmcgYnJva2Vu IGJ5IHNvbWUgY2hhcmFjdGVycworCisgICAgICAgICogZmFzdC9sb2FkZXIvamF2YXNjcmlwdC11 cmwtZW5jb2RpbmctMi1leHBlY3RlZC50eHQ6CisgICAgICAgICogZmFzdC9sb2FkZXIvamF2YXNj cmlwdC11cmwtZW5jb2RpbmctMi5odG1sOgorCiAyMDA4LTExLTA4ICBBbnR0aSBLb2l2aXN0byAg PGFudHRpQGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBTYW0gV2VpbmlnLgpJbmRl eDogTGF5b3V0VGVzdHMvZmFzdC9sb2FkZXIvamF2YXNjcmlwdC11cmwtZW5jb2RpbmctMi1leHBl Y3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9sb2FkZXIvamF2YXNjcmlw dC11cmwtZW5jb2RpbmctMi1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0 cy9mYXN0L2xvYWRlci9qYXZhc2NyaXB0LXVybC1lbmNvZGluZy0yLWV4cGVjdGVkLnR4dAkocmV2 aXNpb24gMCkKQEAgLTAsMCArMSBAQAorU2hvdWxkIGJlIEN5cmlsbGljIHRleHQsIG5vdCBVK0ZG RkQgUkVQTEFDRU1FTlQgQ0hBUkFDVEVSUzog0J/RgNC+0LLQtdGA0LrQsAoKUHJvcGVydHkgY2hh bmdlcyBvbjogTGF5b3V0VGVzdHMvZmFzdC9sb2FkZXIvamF2YXNjcmlwdC11cmwtZW5jb2Rpbmct Mi1leHBlY3RlZC50eHQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXwpOYW1lOiBzdm46bWltZS10eXBlCiAgICsgdGV4dC9w bGFpbgpOYW1lOiBzdm46ZW9sLXN0eWxlCiAgICsgbmF0aXZlCgpJbmRleDogTGF5b3V0VGVzdHMv ZmFzdC9sb2FkZXIvamF2YXNjcmlwdC11cmwtZW5jb2RpbmctMi5odG1sCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IExheW91dFRlc3RzL2Zhc3QvbG9hZGVyL2phdmFzY3JpcHQtdXJsLWVuY29kaW5nLTIuaHRtbAko cmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvbG9hZGVyL2phdmFzY3JpcHQtdXJsLWVu Y29kaW5nLTIuaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwxNSBAQAorPGhlYWQ+Cis8bWV0 YSBjaGFyc2V0PSJ3aW5kb3dzLTEyNTEiPgorPHNjcmlwdD4KK2Z1bmN0aW9uIHRlc3QoKQorewor ICAgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpIHsKKyAgICAgICAgbGF5b3V0VGVz dENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci53 YWl0VW50aWxEb25lKCk7CisgICAgfQorICAgIHdpbmRvdy5sb2NhdGlvbi5ocmVmPSJqYXZhc2Ny aXB0Oic8cCBmb289XCI/XCI+U2hvdWxkIGJlIEN5cmlsbGljIHRleHQsIG5vdCBVK0ZGRkQgUkVQ TEFDRU1FTlQgQ0hBUkFDVEVSUzogz/Du4uXw6uA8L3A+PHNjcmlwdD5pZiAod2luZG93LmxheW91 dFRlc3RDb250cm9sbGVyKSBsYXlvdXRUZXN0Q29udHJvbGxlci5ub3RpZnlEb25lKCk8L3NjciIg KyAiaXB0PiciOworfQorPC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keSBvbmxvYWQ9InRlc3QoKSI+ Cis8L2JvZHk+CgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlvdXRUZXN0cy9mYXN0L2xvYWRlci9q YXZhc2NyaXB0LXVybC1lbmNvZGluZy0yLmh0bWwKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpOYW1lOiBzdm46bWltZS10 eXBlCiAgICsgdGV4dC9odG1sCgo=