attributionsrc set by window.open is broken with respect to URL parameters

[apasel422]

The inability to use = within a feature parameter for window.open is a limitation of both the specification and Chromium's implementation. For example, attributionsrc=https://a.test?x=y&h=j gets interpreted as:

attributionsrc = https://a.test?x
y&h = j

Some solutions we could consider:

1. Modify the window.open spec and implementation to permit escaping/quoting of values.
2. Require attributionsrc feature values to be URL-encoded and perform URL-decoding on them before using them.
3. Stop using feature strings altogether and specify attributionsrc via a separate parameter to window.open.

Originally reported in https://groups.google.com/a/chromium.org/g/attribution-reporting-api-dev/c/_Q_dYzbSo38.

[alois-bissuel]

Thanks for tracking this here.
All mentioned solutions are fine for us (with maybe a preference for 2 and 3).
Meanwhile we will encode the query part of the URL, so that the equal signs are escaped, and we will decode it in our endpoint.

[apasel422]

I am leaning toward option 2 myself, as it doesn't require option 1's modification of the HTML spec (with the backwards-compatibility concerns that might entail) and doesn't require adding a completely separate API surface as in option 3.

[csharrison]

I agree 2 seems like the simplest option. 3 was how the feature was originally implemented and there was a whole host of compat issues with adding more params to window.open.

[maudnals]

2 seems OK to me too, I can gather additional input regarding developer experience to confirm