12606 2011-05-05 12:29:37 +0000 Form submission should convert all line breaks to CR LF pairs in field names and values 2011-09-06 07:23:25 +0000 1 1 1 Unclassified HTML WG LC1 HTML5 spec unspecified PC Windows XP RESOLVED FIXED P2 normal --- 1 hsteen ian annevk brunoaiss ian james mike public-html-admin public-html-wg-issue-tracking shadow2531 public-html-bugzilla oldest_to_newest 48082 0 985 hsteen 2011-05-05 12:29:37 +0000 Created attachment 985 demo with fields set to CR and LF, reports .value and on submit you'll see the encoded result in the URL field Browsers tend to normalize stray CR and LF characters to CRLF when submitting a form. The algorithm on http://www.whatwg.org/specs/web-apps/current-work/multipage/association-of-controls-and-forms.html#application/x-www-form-urlencoded-encoding-algorithm doesn't seem to special-case CR and LF at all, I believe this is required. This applies to both textarea and input type=hidden. 49967 1 ian 2011-06-21 06:14:51 +0000 Is the test case online anywhere for easy testing? 50013 2 hsteen 2011-06-21 09:08:05 +0000 I've put a copy on http://hallvord.com/temp/W3-12606.htm - you'll still need to look at the address bar to see what was actually sent though. 54100 3 mike 2011-08-04 05:36:04 +0000 mass-move component to LC1 54615 4 ian 2011-08-10 19:18:57 +0000 For textarea this is already required, search for "The element's value is defined to be the element's raw value with the following transformation applied". Do we really want to be fiddling with JavaScript-assigned values in <input type=hidden>? 55067 5 annevk 2011-08-15 10:20:02 +0000 (If this applies to text/plain that format can be reliably decoded in theory.) 55082 6 hsteen 2011-08-15 13:36:44 +0000 (In reply to comment #4) > Do we really want to be fiddling with JavaScript-assigned values in <input > type=hidden>? Since a vast majority of existing UAs do, I believe we should. (Tested IE, Firefox and Chrome - all normalize JS-assigned values. Only Opera differs, it has not caused us problems that I'm aware of but we intend to change anyway.) Additionally, Firefox and Chrome normalize form element names with CRs or LFs in them. Haven't checked if this happens during parsing or submit. 55629 7 ian 2011-08-22 23:08:01 +0000 Please file a separate bugs for the names if you want that looked at. Note that the parser _definitely_ fiddles with CR and LF, so please make sure to create everything in the DOM, not via the parser, when testing this. 55634 8 ian 2011-08-22 23:55:38 +0000 Actually nevermind. This seems to affect all names and values in a form, and it does seem to happen at submission. Also it doesn't seem limited to the x-www-form-urlencoded type. http://software.hixie.ch/utilities/js/live-dom-viewer/saved/1117 56364 9 ian 2011-09-06 07:23:01 +0000 EDITOR'S RESPONSE: This is an Editor's Response to your comment. If you are satisfied with this response, please change the state of this bug to CLOSED. If you have additional information and would like the editor to reconsider, please reopen this bug. If you would like to escalate the issue to the full HTML Working Group, please add the TrackerRequest keyword to this bug, and suggest title and text for the tracker issue; or you may create a tracker issue yourself, if you are able to do so. For more details, see this document: http://dev.w3.org/html5/decision-policy/decision-policy.html Status: Accepted Change Description: see diff given below Rationale: Made it apply all the time. 56366 10 contributor 2011-09-06 07:23:25 +0000 Checked in as WHATWG revision r6542. Check-in comment: Match reality: form submission normalises newlines. http://html5.org/tools/web-apps-tracker?from=6541&to=6542 985 2011-05-05 12:29:37 +0000 2011-05-05 12:29:37 +0000 demo with fields set to CR and LF, reports .value and on submit you'll see the encoded result in the URL field CORE-20160-tangential.htm text/html 1092 hsteen PCFET0NUWVBFIGh0bWw+DQo8aHRtbD48aGVhZD4NCgk8dGl0bGU+IENSIGFuZCBMRiBjaGFyYWN0 ZXJzIGFzIGhpZGRlbiBpbnB1dCB2YWx1ZSBzdHJpbmdzIDwvdGl0bGU+DQo8L2hlYWQ+DQo8Ym9k eT4NCg0KCTxwPkZBSUxFRCAoVGhpcyBUQyByZXF1aXJlcyBKYXZhU2NyaXB0IGVuYWJsZWQpPC9w Pg0KCTxmb3JtIGFjdGlvbj0iIiBuYW1lPSJmb3JtMSI+DQoJCTxpbnB1dCB0eXBlPSJoaWRkZW4i IG5hbWU9ImxmIj4NCgkJPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iY3IiPg0KCQk8dGV4dGFy ZWEgbmFtZT0ibGYyIj48L3RleHRhcmVhPg0KCQk8dGV4dGFyZWEgbmFtZT0iY3IyIj48L3RleHRh cmVhPg0KCQk8aW5wdXQgdHlwZT0ic3VibWl0Ij4NCgk8L2Zvcm0+DQoNCgk8c2NyaXB0IHR5cGU9 InRleHQvamF2YXNjcmlwdCI+DQoJDQoJZnVuY3Rpb24gdGVzdCgpew0KCQl2YXIgbG9nPWRvY3Vt ZW50LmdldEVsZW1lbnRzQnlUYWdOYW1lKCdwJylbMF0uZmlyc3RDaGlsZDsNCgkJZG9jdW1lbnQu Zm9ybXNbMF0uZWxlbWVudHNbMF0udmFsdWU9U3RyaW5nLmZyb21DaGFyQ29kZSgxMCk7DQoJCWRv Y3VtZW50LmZvcm1zWzBdLmVsZW1lbnRzWzFdLnZhbHVlPVN0cmluZy5mcm9tQ2hhckNvZGUoMTMp Ow0KCQlkb2N1bWVudC5mb3Jtc1swXS5lbGVtZW50c1syXS52YWx1ZT1TdHJpbmcuZnJvbUNoYXJD b2RlKDEwKTsNCgkJZG9jdW1lbnQuZm9ybXNbMF0uZWxlbWVudHNbM10udmFsdWU9U3RyaW5nLmZy b21DaGFyQ29kZSgxMyk7DQoJCWxvZy5kYXRhPSdWYWx1ZXMgcmVhZCB0aHJvdWdoIERPTTogJytl bmNvZGVVUklDb21wb25lbnQoZG9jdW1lbnQuZm9ybXNbMF0uZWxlbWVudHNbMF0udmFsdWUpKycs ICcrZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LmZvcm1zWzBdLmVsZW1lbnRzWzFdLnZhbHVl KSsnLCAnK2VuY29kZVVSSUNvbXBvbmVudChkb2N1bWVudC5mb3Jtc1swXS5lbGVtZW50c1syXS52 YWx1ZSkrJywgJytlbmNvZGVVUklDb21wb25lbnQoZG9jdW1lbnQuZm9ybXNbMF0uZWxlbWVudHNb M10udmFsdWUpOw0KCX0NCgl3aW5kb3cub25sb2FkPXRlc3Q7DQoJPC9zY3JpcHQ+DQoNCjwvYm9k eT48L2h0bWw+