[whatwg/url] `search` setter keeps tab and newline in the list but drops them from the query (Issue #931)

spokodev created an issue (whatwg/url#931)

### What is the issue with the URL Standard?

The `search` setter runs two parsers over the same *input*. Step 5 basic-URL-parses it into the URL's query, and step 6 sets the query object's list to the result of parsing *input*. The basic URL parser removes all ASCII tab or newline first; the `application/x-www-form-urlencoded` parser does not. So after `url.search = "a=\tb"` the query is `a=b` but the list is `[["a", "\tb"]]`, and the next `searchParams` mutation rewrites the query from the list.

Test case: [Live DOM Viewer](https://software.hixie.ch/utilities/js/live-dom-viewer/?%3C%21DOCTYPE%20html%3E%0A%3Cscript%3E%0Avar%20a%20%3D%20new%20URL%28%22https%3A%2F%2Fexample.com%2F%22%29%3B%0Aa.search%20%3D%20%22a%3D%5Ctb%22%3B%0Aw%28%221%20%22%20%2B%20JSON.stringify%28%5B...a.searchParams%5D%29%29%3B%0Avar%20b%20%3D%20new%20URL%28%22https%3A%2F%2Fexample.com%2F%22%29%3B%0Ab.searchParams%3B%0Ab.search%20%3D%20%22a%3D%5Ctb%22%3B%0Aw%28%222%20%22%20%2B%20JSON.stringify%28%5B...b.searchParams%5D%29%29%3B%0Avar%20c%20%3D%20new%20URL%28%22https%3A%2F%2Fexample.com%2F%22%29%3B%0Ac.search%20%3D%20%22a%3D%5Ctb%22%3B%0Ac.searchParams.append%28%22c%22%2C%20%22d%22%29%3B%0Aw%28%223%20%22%20%2B%20c.search%29%3B%0A%3C%2Fscript%3E%0A)

| Test case | Blink | Gecko | WebKit | Node.js | spec, whatwg-url |
|---|---|---|---|---|---|
| 1. `url.search = "a=\tb"`, then `[...url.searchParams]` | `[["a","b"]]` | `[["a","b"]]` | `[["a","b"]]` | `[["a","b"]]` | `[["a","\tb"]]` |
| 2. As 1, but `url.searchParams` is read before the setter | `[["a","\tb"]]` | `[["a","b"]]` | `[["a","b"]]` | `[["a","b"]]` | `[["a","\tb"]]` |
| 3. As 1, then `url.searchParams.append("c", "d")`; `url.search` | `?a=b&c=d` | `?a=b&c=d` | `?a=b&c=d` | `?a=b&c=d` | `?a=%09b&c=d` |

Blink is Chrome 154.0.8037.93. Gecko is Firefox 155 and WebKit is 26.6, both as bundled with Playwright. Node.js is 26.0.0 and whatwg-url is 17.2.0. `\n` and `\r` behave the same way as `\t` in every column.

Row 2 means that in Blink, reading the `searchParams` getter, without mutating anything, changes what a later `search` set produces.

WPT does not cover the list: `url/url-setters-stripping.any.js` asserts `search` and `href` after setting `search` with each stripped code point, but never `searchParams`.

This looks like the same shape as #609 for the protocol setter. Either step 6 should parse *input* with ASCII tab and newline removed, which matches Gecko, WebKit and Node.js, or the text stays and they change. I can write the WPT cases once there is a direction.


-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/931
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/931@github.com>