Chromium Code Reviews Chromium Code Reviews
Issue 1031783002:
Escape '&' in javascript URLs for innerHTML/outerHTML (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master| Index: LayoutTests/fast/innerHTML/javascript-url.html |
| diff --git a/LayoutTests/fast/innerHTML/javascript-url.html b/LayoutTests/fast/innerHTML/javascript-url.html |
| index 897d2c6dbbe47b2c15917870cd36d5b1f2e3eb75..b42cf5929076737ae30436208748d0a0514cb887 100644 |
| --- a/LayoutTests/fast/innerHTML/javascript-url.html |
| +++ b/LayoutTests/fast/innerHTML/javascript-url.html |
| @@ -1,62 +1,34 @@ |
| +<!DOCTYPE html> |
| <head> |
|
fs
2015/03/24 10:20:11
You can drop <head></head>
Abhijeet Kandalkar Slow
2015/03/24 14:20:36
Done.
|
| -<script> |
| -if (window.testRunner) |
| - testRunner.dumpAsText(); |
| - |
| -function print(message, color) |
| -{ |
| - var paragraph = document.createElement("div"); |
| - paragraph.appendChild(document.createTextNode(message)); |
| - paragraph.style.fontFamily = "monospace"; |
| - if (color) |
| - paragraph.style.color = color; |
| - document.getElementById("console").appendChild(paragraph); |
| -} |
| - |
| -function run(a) |
| -{ |
| - print(a); |
| - try { |
| - eval(a); |
| - } catch(e) { |
| - print(e); |
| - } |
| -} |
| - |
| -function shouldBe(a, b) |
| -{ |
| - var evalA; |
| - try { |
| - evalA = eval(a); |
| - } catch(e) { |
| - evalA = e; |
| - } |
| - |
| - if (evalA == b) |
| - print("PASS: " + a + " should be " + b + " and is.", "green"); |
| - else |
| - print("FAIL: " + a + " should be " + b + " but instead is " + evalA + ".", "red"); |
| -} |
| -</script> |
| +<script src="../../resources/js-test.js"></script> |
| </head> |
| <body> |
| -Test that innerHTML does not mangle javascript: urls. |
| +Test that innerHTML/outerHTML does not mangle javascript: urls. |
| <div id=console></div> |
| -<div id=jsurltest><a href=' |
| - javascript:test(&37;3C!--D--&37;3E)'>link</a></div> |
| +<div id=jsurltest><a href='javascript:test(&37;3C!--D--&37;3E)'>link</a></div> |
| <script> |
| +if (window.testRunner) |
|
fs
2015/03/24 10:20:11
You can drop this too (js-test.js should do this f
Abhijeet Kandalkar Slow
2015/03/24 14:20:36
Done.
|
| + testRunner.dumpAsText(); |
| + |
| var r = document.getElementById('jsurltest'); |
| -run("r.innerHTML = r.innerHTML.replace(/&37;3C!--D--&37;3E/g, 123)"); |
| -shouldBe("r.innerHTML.indexOf('javascript:test(123)') > -1", true); |
| -run("r.firstChild.setAttribute('href', 'javascript:test(\"text<\")')"); |
| -shouldBe("r.innerHTML.indexOf('javascript:test(\"text<\")') > -1", true); |
| -run('r.firstChild.setAttribute("href", "javascript:test(\'text>\')")'); |
| -shouldBe('r.innerHTML.indexOf("javascript:test(\'text>\')") > -1', true); |
| + |
| +r.innerHTML = r.innerHTML.replace('&37;3C!--D--&37;3E', 123); |
| +shouldBeEqualToString('r.innerHTML', '<a href="javascript:test(123)">link</a>'); |
| + |
| +r.firstChild.setAttribute('href', 'javascript:test(\"text<\")'); |
| +shouldBeEqualToString("r.innerHTML", '<a href=\'javascript:test("text<")\'>link</a>'); |
| + |
| +r.firstChild.setAttribute("href", "javascript:test(\'text>\')"); |
| +shouldBeEqualToString("r.innerHTML", '<a href="javascript:test(\'text>\')">link</a>'); |
| + |
| testString = 'javascript:test(\'text&\',"test2&")'; |
| -print("testString = " + testString); |
| -run('r.firstChild.setAttribute("href", testString)'); |
| -shouldBe('r.innerHTML.indexOf("javascript:test(\'text&\',"test2&")") > 1', true); |
| +r.firstChild.setAttribute("href", testString); |
| +shouldBeEqualToString("r.innerHTML", '<a href="javascript:test(\'text&\',"test2&")">link</a>'); |
| + |
| +r.firstChild.href = "javascript:window.location='?x&y'"; |
| +shouldBeEqualToString("r.firstChild.outerHTML", '<a href="javascript:window.location=\'?x&y\'">link</a>'); |
| -run("r.firstChild.setAttribute('href', 'http://www.google.fi/search?q=scarlett johansson&meta=&btnG=Google-haku')"); |
| +r.firstChild.setAttribute('href', 'http://www.google.fi/search?q=scarlett johansson&meta=&btnG=Google-haku'); |
| print(r.innerHTML); |
|
fs
2015/03/24 10:20:11
Convert this to a proper "assertion" too?
Abhijeet Kandalkar Slow
2015/03/24 14:20:36
print(r.innerHTML); is not needed, Removed it.
|
| </script> |
| +</html> |
|
fs
2015/03/24 10:20:11
Drop this.
Abhijeet Kandalkar Slow
2015/03/24 14:20:36
Done.
|
