Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Content suggestion: javascript pseudo-protocol identifier #7143

Closed
jxu opened this issue Jul 21, 2021 · 2 comments · Fixed by #35599
Closed

Content suggestion: javascript pseudo-protocol identifier #7143

jxu opened this issue Jul 21, 2021 · 2 comments · Fixed by #35599
Labels
Content:Other Any docs not covered by another "Content:" label document not written Missing document page help wanted If you know something about this topic, we would love your help!

Comments

@jxu
Copy link
Contributor

jxu commented Jul 21, 2021

What is the new suggestion?

Document the javascript pseudo-protocol identifier javascript: which supposedly can be used anywhere a URL can to run javascript? Someone who has been doing web developer longer than I have can write about the history.

Why is it important or useful?

It is supposedly a pseudo-protocol, meaning it was/is supported on older browsers? The info that exists is scattered across old blogposts and stack overflow answers. Given the sheer number of duplicate stack overflow questions, it is not a rare topic.

Probably important for XSS.

Other supporting information

Answers are vague about history and browser support

https://stackoverflow.com/questions/2321469/when-do-i-need-to-specify-the-javascript-protocol

https://stackoverflow.com/questions/10068781/what-does-the-javascript-pseudo-protocol-actually-do?noredirect=1&lq=1

https://crisp.tweakblogs.net/blog/313/the-useless-javascript-pseudo-protocol.html from 2006

https://social.msdn.microsoft.com/Forums/ie/en-US/ac6bc491-e3d3-49eb-a010-8c36bd068016/javascript-pseudoprotocol-doesnt-work-why?forum=iewebdevelopment

@sideshowbarker sideshowbarker added the help wanted If you know something about this topic, we would love your help! label Jul 22, 2021
@sideshowbarker
Copy link
Collaborator

We do have some guidance in the Never use this form of code for links: <a href="javascript:window.open(...)" ...> section of https://developer.mozilla.org/en-US/docs/Web/API/Window/open

As far as an actual specification, https://html.spec.whatwg.org/multipage/browsing-the-web.html#javascript-protocol is where the browser requirements are defined.

@jxu
Copy link
Contributor Author

jxu commented Jul 22, 2021

I can attempt a draft but I barely know about the protocol so it would likely not be written very professionally

@Rumyra Rumyra added the needs triage Triage needed by staff and/or partners. Automatically applied when an issue is opened. label Nov 25, 2021
@sideshowbarker sideshowbarker added document not written Missing document page and removed needs triage Triage needed by staff and/or partners. Automatically applied when an issue is opened. Opportunity assessment labels Feb 19, 2022
@Josh-Cena Josh-Cena added the Content:WebAPI Web API docs label Jul 4, 2022
@Josh-Cena Josh-Cena added Content:Other Any docs not covered by another "Content:" label and removed Content:WebAPI Web API docs area: URL/URLPattern labels Aug 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Content:Other Any docs not covered by another "Content:" label document not written Missing document page help wanted If you know something about this topic, we would love your help!
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants