[Webkit-unassigned] [Bug 30982] New: createHTMLDocument doesn't escape ampersand and less-than in title

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=30982

           Summary: createHTMLDocument doesn't escape ampersand and
                    less-than in title
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: nanto at moon.email.ne.jp


|document.implementation.createHTMLDocument(title)| wrongly parses the value of
the title parameter as a part of HTML source, violating both old DOM2 HTML CR
[1] and HTML5 [2].

[1]
http://www.w3.org/TR/2002/CR-DOM-Level-2-HTML-20020605/html.html#HTML-DOM-createHTMLDocument
[2]
http://www.whatwg.org/specs/web-apps/current-work/multipage/dom.html#dom-domhtmlimplementation-createhtmldocument

Steps to reproduce: Execute the following JavaScript code:
javascript:alert(document.implementation.createHTMLDocument('foo</title>').title);

Expected result: foo</title>
Actual result: foo

Confirmed on WebKit-r50095.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.