[Webkit-unassigned] [Bug 18421] XMLHttpRequest does not properly encode & and < in outgoing messages

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=18421





------- Comment #4 from keith at app2you.com  2008-04-10 22:46 PDT -------
Here is some additional discussion that occurred on the dev list, for future
reference:

Erik Seidel:

The FF/IE behavior looks to be in disagreement with the spec:

http://www.w3.org/TR/XMLHttpRequest/#send

So it seems like both the spec and our code should be changed.

Please file a bug:
http://webkit.org/quality/reporting.html

Bugs reported on the mailing list are unlikely to be fixed unless also
added to the bugs database.

-eric




Me:

Hi Eric,

    Thanks for the quick response. Based upon the way I interpret the spec, it
seems as though FF and IE are in agreement. Specifically, the spec states that
send() should "Serialize data into a namespace well-formed XML document and
encoded using the encoding given by data.xmlEncoding, if specified, or UTF-8
otherwise." Looking at the XML spec (
http://www.w3.org/TR/2006/REC-xml-20060816/#sec-well-formed), a well formed
document should exclude < and & from attribute and entity values. Therefore, it
seems as though FF/IE are doing the correct thing in escaping these characters,
where-as Safari is not. Maybe I'm interpreting something wrong, though?

    I have filed a bug #18421 about the issue. What is the general processes
for looking at/prioritizing bugs within WebKit?

    Thanks,
        Keith




Eric Seidel:

My apologies.

I misread your message.  You are correct.  Our behavior seems wrong to
me too.  Please file a bug.

-eric


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.