On 09/12/2011 12:47 PM, Michal Zalewski wrote:
What about javascript: URLs?Right now, every browser seems to treat javascript:alert('#') in an "intuitive" manner.
FWIW -- in Gecko, I believe we actually do split "#')" out as a fragment identifier there (under-the-hood in our URI parsing code).
However, fragment identifiers don't have any special significance in "javascript:" URIs, so the "javascript:" handler ends up requesting the full URI, ignoring any distinction between the pre-# and post-# part.
~Daniel
