Add a runtime enabled feature for Dangling Markup in target name

Implementation for whatwg/html#9309. Bug: 1421440 Change-Id: I704ecbc0f18e48c32966a77bae2307e96eb44073 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4553305 Commit-Queue: Jun Kokatsu <jkokatsu@google.com> Reviewed-by: Mike West <mkwst@chromium.org> Cr-Commit-Position: refs/heads/main@{#1150017}
web-platform-tests · Feb 7, 2024 · 1096455 · 1096455
1 parent 7d5a9bc
commit 1096455
Show file tree

Hide file tree

Showing 2 changed files with 98 additions and 1 deletion.
diff --git a/html/browsers/windows/dangling-markup-window-name.tentative.html b/html/browsers/windows/dangling-markup-window-name.tentative.html
@@ -0,0 +1,97 @@
+<!doctype html>
+<html>
+<head>
+  <title>Dangling Markup in target</title>
+  <meta name="timeout" content="long">
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+  <script src="/common/utils.js"></script>
+</head>
+<body>
+  <script>
+    function anchorClick(target, id) {
+      const hyperlink = document.body.appendChild(document.createElement('a'));
+      if (target) {
+        hyperlink.target = target;
+      }
+      hyperlink.href = `resources/window-name.sub.html?report=${id}|close`;
+      hyperlink.click();
+    }
+
+    async function pollResultAndCheck(t, id, expected) {
+      const stashURL = new URL('resources/window-name-stash.py', location);
+      stashURL.searchParams.set('id', id);
+
+      let res = 'NONE';
+      while (res == 'NONE') {
+        await new Promise(resolve => { t.step_timeout(resolve, 100); });
+
+        const response = await fetch(stashURL);
+        res = await response.text();
+      }
+      if (res !== expected) {
+        assert_unreached('Stash result does not equal expected result.')
+      }
+    }
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\n<' + id;
+
+      window.open(`resources/window-name.sub.html?report=${id}|close`, value);
+      await pollResultAndCheck(t, id, value);
+    }, 'Dangling Markup in target is not reset when set by window.open');
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\n<' + id;
+
+      anchorClick(value, id)
+      await pollResultAndCheck(t, id, '');
+    }, 'Dangling Markup with "\\n" in target is reset when set by <a> tag');
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\r<' + id;
+
+      anchorClick(value, id)
+      await pollResultAndCheck(t, id, '');
+    }, 'Dangling Markup with "\\r" in target is reset when set by <a> tag');
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\t<' + id;
+
+      anchorClick(value, id)
+      await pollResultAndCheck(t, id, '');
+    }, 'Dangling Markup with "\\t" in target is reset when set by <a> tag');
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\n<' + id;
+
+      const form = document.body.appendChild(document.createElement('form'));
+      form.target = value;
+      form.method = 'GET';
+      form.action = 'resources/window-name.sub.html';
+      const input = form.appendChild(document.createElement('input'));
+      input.type = 'hidden';
+      input.name = 'report';
+      input.value = `${id}|close`;
+      form.submit();
+
+      await pollResultAndCheck(t, id, '');
+    }, 'Dangling Markup in target is reset when set by <form> tag');
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\n<' + id;
+      const base = document.head.appendChild(document.createElement('base'));
+      base.target = value;
+
+      anchorClick(null, id)
+      await pollResultAndCheck(t, id, '');
+    }, 'Dangling Markup in target is reset when set by <base> tag');
+  </script>
+</body>
+</html>
diff --git a/html/browsers/windows/resources/window-name.sub.html b/html/browsers/windows/resources/window-name.sub.html
@@ -2,7 +2,7 @@
 <title>popup helper</title>
 <script>
 
-const search = window.location.search.replace("?", "");
+  const search = decodeURIComponent(window.location.search.replace("?", ""));
 const steps = search.split("|");
 
 async function proceedTest() {