Page MenuHomePhabricator

document.write() results in a blank page
Closed, ResolvedPublic

Description

After the recent RL changes, document.write() replaces page content with its argument, which would totally screw users who copied some ancient code to their user scripts, and would confuse a lot of even technically apt users. An option to reduce the impact could be to override this function with a dummy that outputs an error message instead of completely ruining everything.

Reproduceable on betalabs with http://en.wikipedia.beta.wmflabs.org/wiki/User:MaxSem/monobook.js

Event Timeline

MaxSem raised the priority of this task from to Unbreak Now!.
MaxSem updated the task description. (Show Details)
MaxSem added subscribers: MaxSem, ori, Krinkle.

All I can say is good work. It's unfortunate people are using document.write and it's a good lesson for them to learn :)
I would suggest we reach out to users via their talk pages so they can prepare for this change and are aware about what needs to be done and how they can fix it.

We can't just not do this because it breaks things. If we take that approach nothing will ever get done.

All I can say is good work. It's unfortunate people are using document.write and it's a good lesson for them to learn :)

No, we're not actively looking to punish users, and blanking pages is a little extreme.

document.write was the recommended way to add scripts to your user JS for some years around 2007 (possibly longer on non-English Wikipedias, which copied the instructions from English once and them forgot about them). Even if the scripts added back then might no longer work, they are still no doubt being loaded by many users in this way.

https://en.wikipedia.org/w/index.php?title=Template:Js&diff=110826559&oldid=85043741
https://pl.wikipedia.org/w/index.php?title=Szablon:JS&diff=14254251&oldid=7169012

Something like this might be sufficient?

document.write = function ( html ) { $( 'body' ).append( html ); };
Krinkle added a project: Regression.
Krinkle set Security to None.

Change 229619 had a related patch set uploaded (by Krinkle):
Replace native "document.write" with deprecated fallback

https://gerrit.wikimedia.org/r/229619

Change 229619 merged by jenkins-bot:
Replace native "document.write" with deprecated fallback

https://gerrit.wikimedia.org/r/229619

Change 229622 had a related patch set uploaded (by Krinkle):
Replace native "document.write" with deprecated fallback

https://gerrit.wikimedia.org/r/229622

Change 229622 merged by jenkins-bot:
Replace native "document.write" with deprecated fallback

https://gerrit.wikimedia.org/r/229622

Confirmed fixed.

This change is going to result in an awful lot of people's scripts being broken. A search on enwiki for document.write intitle:".js" in the User and Mediawiki namespaces gets 11,477 results (and one of them is Jimbo's monobook.js).

This change is going to result in an awful lot of people's scripts being broken. A search on enwiki for document.write intitle:".js" in the User and Mediawiki namespaces gets 11,477 results (and one of them is Jimbo's monobook.js).

Yes, but please beware that this number may not represent what you think. For example, Jimbo may have a monobook.js file that uses the document-write functionality, but he himself is no longer using Monobook. The file is left untouched because it's unused.

Similarly, lots of matches in that search query are for subpages like "User:<name>/<some-gadget>.js" where users created a draft revision for a gadget or some other script but is not actively loaded by that user.

Restricted Application added a subscriber: TerraCodes. · View Herald Transcript