[Webkit-unassigned] [Bug 8770] XMLHttpRequest should strip CR/LF characters from the URL

[bugzilla-daemon at opendarwin.org]

http://bugzilla.opendarwin.org/show_bug.cgi?id=8770


ap at nypop.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|webkit-                     |ap at nypop.com
                   |unassigned at opendarwin.org   |
             Status|NEW                         |ASSIGNED
   Attachment #8251|                            |review?
               Flag|                            |




------- Comment #2 from ap at nypop.com  2006-05-11 12:58 PDT -------
Created an attachment (id=8251)
 --> (http://bugzilla.opendarwin.org/attachment.cgi?id=8251&action=view)
proposed fix

Yes, both Firefox and WinIE strip CR, LF and TAB, and this happens for all
URLs, not just XMLHttpRequest (I've tried IFRAME SRC, window.location and META
HTTP-EQUIV Refresh). No other characters from 0x01... 0x20 are stripped (as
tested with Firefox).

No idea why they do this, doesn't really look like a security measure. My only
wild guess is that this behavior originates with Gopher selector syntax :-)


-- 
Configure bugmail: http://bugzilla.opendarwin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
You are the assignee for the bug, or are watching the assignee.