Opened 12 years ago

Closed 12 years ago

#11052 closed defect (fixed)

Invalid/bad input in IE can generate bizarre output from Editor

Reported by: Jared Jurkiewicz Owned by: Jared Jurkiewicz
Priority: high Milestone: 1.5
Component: Editor Version: 1.5.0b1
Keywords: Cc:
Blocked By: Blocking:


First reported by a co-worker, and I've verified the issue. This is another case where IE does not handle bad input well. For example, if you call:

editor.attr("value", "<table><tbody><tr><td>test</td>");

And then call:


You will get back something like:

<table><tbody><tr><td>test</td>< accessKey="" align="" class="" contentEditable="inherit" dataFld="null" dataFormatAs="null" dataSrc="null" dir="" disabled="false" hideFocus="false" id="" implementation="null" lang="" language="" onactivate="null" onafterupdate="null" onbeforeactivate="null" onbeforecopy="null" onbeforecut="null" onbeforedeactivate="null" onbeforeeditfocus="null" onbeforepaste="null" onbeforeupdate="null" onblur="null" oncellchange="null" onclick="null" oncontextmenu="null" oncontrolselect="null" oncopy="null" oncut="null" ondataavailable="null" ondatasetchanged="null" ondatasetcomplete="null" ondblclick="null" ondeactivate="null" ondrag="null" ondragend="null" ondragenter="null" ondragleave="null" ondragover="null" ondragstart="null" ondrop="null" onerrorupdate="null" onfilterchange="null" onfocus="null" onfocusin="null" onfocusout="null" onhelp="null" onkeydown="null" onkeypress="null" onkeyup="null" onlayoutcomplete="null" onlosecapture="null" onmousedown="null" onmouseenter="null" onmouseleave="null" onmousemove="null" onmouseout="null" onmouseover="null" onmouseup="null" onmousewheel="null" onmove="null" onmoveend="null" onmovestart="null" onpage="null" onpaste="null" onpropertychange="null" onreadystatechange="null" onresize="null" onresizeend="null" onresizestart="null" onrowenter="null" onrowexit="null" onrowsdelete="null" onrowsinserted="null" onscroll="null" onselectstart="null" style="null" tabIndex="0" title="" vAlign="" /></tr></tbody></table>

Notice the very malformed tag: < accessKey="" align=""

This is because IE has actually cross-linked/created a tag that has no tag name and apparently yanked atributes from the editor. Very bad.

Fortunately this is also VERY ieasy to work around:

In dijit._editor.getNodeHtml

If you get something that has a tag Name (lName in the code), that is blank, just return "" for the node text, as the node is corrupt.

Testcase coming soon. As is patch.

Attachments (2)

test_Editor.html (1.7 KB) - added by Jared Jurkiewicz 12 years ago.
malform.patch (534 bytes) - added by Jared Jurkiewicz 12 years ago.
And the simple patch! Adjustment of checks we already do.

Download all attachments as: .zip

Change History (3)

Changed 12 years ago by Jared Jurkiewicz

Attachment: test_Editor.html added


Changed 12 years ago by Jared Jurkiewicz

Attachment: malform.patch added

And the simple patch! Adjustment of checks we already do.

comment:1 Changed 12 years ago by Jared Jurkiewicz

Resolution: fixed
Status: newclosed

Fixed in [22005]

Note: See TracTickets for help on using tickets.