New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 633153 link

Starred by 7 users

Issue metadata

Status: Assigned
Owner:
Buried. Ping if important.
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 3
Type: Bug



Sign in to add a comment

`URLSearchParams` doesn’t perform UTF-8 decoding unlike Gecko’s implementation

Project Member Reported by math...@qiwi.be, Aug 1 2016

Issue description

What steps will reproduce the problem?

    new URLSearchParams('foo=%EF%BF%BF').get('foo')

What is the expected output?

In Firefox, the result is:

    '\uFFFF'

What do you see instead?

In Chromium, the result is:

    '\xEF\xBF\xBF'

This is a compatibility issue.
 
Components: -Blink>DOM Blink>Network

Comment 2 by math...@qiwi.be, Aug 1 2016

Cc: annevank...@gmail.com

Comment 3 by phistuck@gmail.com, Aug 1 2016

Are there web platform tests for this behavior?
Or does Blink simply not run them?
decodeURLEscapeSequences() doesn't perform UTF-8 decoding as specified in https://url.spec.whatwg.org/#concept-urlencoded-parser

Comment 6 by math...@qiwi.be, Aug 1 2016

> decodeURLEscapeSequences() doesn't perform UTF-8 decoding as specified in https://url.spec.whatwg.org/#concept-urlencoded-parser

AFAICT it does — see step 1 and step 8.

Also note that for `new URLSearchParams(str)`, https://url.spec.whatwg.org/#concept-urlencoded-string-parser is used instead, which UTF-8-encodes first. (Search for “To create a new URLSearchParams object” in the spec.)
> Comment 6

Sorry. I meant that decodeURLEscapeSequences() isn't doing what's required in the spec, and that's what we should fix, in comment 4.
Status: Available (was: Untriaged)
I thought I changed the status to Available in comment 4 but I failed to.
I was wrong. decodeURLEscapeSequences() does decoding but leaves high/low surrogates and Unicode noncharacter code points not decoded.

url::ReadUTFChar() does that which is used by url::DecodeURLEscapeSequences() used by blink::decodeURLEscapeSequences().

Need to add option or create a new variant that uses base::ConvertUnicode() instead.
https://github.com/w3c/web-platform-tests/pull/4517 has some tests for this as well which Chrome fails (also has some Firefox failures).
Project Member

Comment 11 by sheriffbot@chromium.org, Mar 9 2018

Labels: Hotlist-Recharge-Cold
Status: Untriaged (was: Available)
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available. If you change it back, also remove the "Hotlist-Recharge-Cold" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 12 by ricea@chromium.org, Mar 12 2018

Labels: -Hotlist-Recharge-Cold
Status: Assigned (was: Untriaged)

Sign in to add a comment