Firefox blocks redirection if URL contains high characters

[RomanKrejci]

Hi all,

I have a simple script on my web page tha appends one long argument
to the URL and redirects:

function GoToUrlArg(_argtype,_href){
 var s=GetArgValue(_argtype);
 a_href=_href+s;
 window.location.href=a_href;
 return (false)}
 

the function call is placed in an anchor tag in html:

<A HREF="javascript:GoToUrlArg(2,'http://myhost.com?ID=aaaaa')">..</A>

if ID value contains escaped high characters, like for example

ID=%F8e%F8icha

redirection is blocked by Netscape 8.1 browser (nothing happens after click on the link).
It is the high character that matters. Escaped low characters (e.g. "/", like
ID=P425-941%2F3%2C5) causes no problem.

IE (both 6 and 7) redirect as expected.
What is going on here? Is this some new firefox security improvement?

[drhowarddrfine]

An id is not allowed in the standard to begin with a '%'.

[RomanKrejci]

Thank you for your reply. What standard states that an URL argument cannot start with %? Please note that this is URL argument and NOT the ID of the Html element! The name of URL argument can be (almost) whatever you choose. I could easily change the name of the argument from ID to BLAH and nothing changes. Firefox will still not redirect. Moreover, the fact that the escaped character is the first one in the argument value (and therefore the value starts with %) is unimportant. Prefixing the value with any english character does not change the Firefox behaviour.

[acoder]

Do you get any errors?

[RomanKrejci]

Do you get any errors?

No error message, no error entry in the JavaScript console. Netscape
just does absolutely nothing.

I just managed to reproduce the behaviour in a simple example:
launch JavaScript console in Netscape 8.1, enter

window.location.href='http://microsoft.com'

and press evaluate. The window will get filled with response.

Now add an URL argument ARG:

window.location.href='http://microsoft.com?ARG=a'

and press evaluate. Again - the result window gets response.

Now include escaped high character in the argument:

window.location.href='http://microsoft.com?ARG=a%F2'

and press evaluate. Nothing happens.

Now include escaped low character in the argument:

window.location.href='http://microsoft.com?ARG=a%77'

and press evaluate. The result window gets response.

[acoder]

This is probably for non-ASCII characters. Can you identify the characters that don't work from, for example, this list. Is the encoding UTF-8? If not, you may need to change the settings?

[RomanKrejci]

This is probably for non-ASCII characters. Can you identify the characters that don't work from, for example, this list. Is the encoding UTF-8? If not, you may need to change the settings?

yes, this is for non-ASCII characters, that's what I am complaining about.
I tried all the high characters in JavaScript console expresion

window.location.href='http://microsoft.com?ARG=aX'
(where X is the escaped high character, like, for example, %90)
and the result is:

with %90 - %BF I get "unterminated string literal" error
with %C0 - %FE Netscape does nothing - no error, no response
with %FF I get "unterminated string literal" error again

The encoding of my original web page is UTF-8, but the encoding does not
play role in JavaScript console, so encoding should not matter.

The unpleasant consequence of this behaviour is that I cannot pass
values conaining accented characters as arguments in http GET request, which seriously breaks my project :-(((

[acoder]

The unpleasant consequence of this behaviour is that I cannot pass values conaining accented characters as arguments in http GET request, which seriously breaks my project :-(((

I've no idea what might be causing this. It may well be a bug though I'm not sure. Perhaps you could submit a bug report and see what happens.

[torinaga]

I know that this is a little bit late, but I was searching for the same thing when I came upon this thread and it helped me answer the question.

You probably need to do something like this.

window.location = encodeURI("http://mySuperSweetURL.com/?action=winTheLottery");

Cheers

[acoder]

You're correct. You could also use encodeURIComponent() around the special non-ASCII characters.

Thanks for your input.