+mgiuca for thoughts. Matt is our current registerProtocolHandler expert.

Also question for Kim: what made you log this bug? Do you know of sites that rely on this / don't work with this?

Yep, this looks like a spec compliance issue.

benwells@ raised the possibility of changing the spec, but honestly I think there's little utility (and it's somewhat surprising) if both instances were replaced. Ultimately, this should never come up, so I share Ben's question about why this came up.

Regardless, we should fix it and it shouldn't be too hard. gyuyoung.kim@: Do you want me to take this?

I see you have a CL up: https://crbug.com/c/808086

>Also question for Kim: what made you log this bug? Do you know of sites that rely on this / don't work with this?

I've fixed some bugs regarding this feature from blink side or added new tests for it. When I fixed a bug in blink, haraken@ asked me about this case.

https://chromium-review.googlesource.com/c/chromium/src/+/796252/1/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtils.cpp#56 

So, I've checked it compared to Firefox and the specification. Then, I found current Chromium behavior is a bit different from Firefox and the specification.

https://crbug.com/c/808086 went a wrong error page. Re-link it again -
 https://chromium-review.googlesource.com/c/chromium/src/+/808086

Oops, I typed it manually. I meant https://crrev.com/c/808086 (you can shorten any code review link with crrev.com/c).

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0fdf6a7698a30d6f62f0f19917dc4bd01164b986

commit 0fdf6a7698a30d6f62f0f19917dc4bd01164b986
Author: Gyuyoung Kim <gyuyoung.kim@lge.com>
Date: Thu Dec 07 06:20:47 2017

[registerProtocolHandler] Only substitute the first "%s" placeholder

The spec says that "When the user agent uses this handler, it must replace the first occurrence of
the exact literal string "%s" in the URL argument".

- Spec: https://html.spec.whatwg.org/multipage/system-state.html#custom-handlers

So, only the first %s can be changed to the given URL.

For example, let's assume this scenario,
  1. navigator.registerProtocolHandler("test", 'http://example.com/%s/url=%s', 'title');"
  2. <a href="test:duplicated_placeholders">this</a>

According to the specification, destination URL should be
  "http://example.com/test%3Aduplicated_placeholders/url=%s".

But, current Chrome implementation replaces all placeholders with the given custom url as below,
  "http://example.com/test%3Aduplicated_placeholders/url=test%3Aduplicated_placeholders"

Firefox also substitutes only first placeholder when url contains multiple placeholders.

Bug:  791912 
Change-Id: Ic3d439c68ac35d776afa6b6907ecdc0da774b08e
Reviewed-on: https://chromium-review.googlesource.com/808086
Commit-Queue: Gyuyoung Kim <gyuyoung.kim@lge.com>
Reviewed-by: Matt Giuca <mgiuca@chromium.org>
Reviewed-by: Ben Wells <benwells@chromium.org>
Cr-Commit-Position: refs/heads/master@{#522360}
[modify] https://crrev.com/0fdf6a7698a30d6f62f0f19917dc4bd01164b986/chrome/browser/custom_handlers/protocol_handler_registry_unittest.cc
[modify] https://crrev.com/0fdf6a7698a30d6f62f0f19917dc4bd01164b986/chrome/common/custom_handlers/protocol_handler.cc