Page MenuHomePhabricator

Extension use in headlines causing headache
Closed, DuplicatePublic

Description

TL;DR Extensions in headlines create bad fragment identifiers.

Steps to reproduce

Create a headline like

== Number <math>\pi</math> for circles ==

Note that the following is not affected:

== Some <nowiki>ikiwon</nowiki> escape ==

Inspect HTML code, look for the fragment.

Live example.

Problem 1

NoScript add-on regards this as malware attack and sanitizes it.

[NoScript InjectionChecker] JavaScript Injection in ///wiki/Kapazität_(Mathematik)#'"`UNIQ--postMath-0000002A-QINU`"'-Fuzzy-Ma�e_von_Sugeno
(function anonymous() {
`UNIQ--postMath-0000002A-QINU` /* COMMENT_TERMINATOR */
DUMMY_EXPR
})
Original URL:
https://de.wikipedia.org/wiki/Kapazit%C3%A4t_(Mathematik)#%7F%27%22%60UNIQ--postMath-0000002A-QINU%60%22%27%7F-Fuzzy-Ma%C3%9Fe_von_Sugeno

Problem 2

Sizzle (the DOM transversal engine of jquery) crashes.

  • Might be improved there, but obviously too many strange things.
Error: Syntax error, unrecognized expression: [id='?'"`UNIQ--postMath-0000002A-QINU`"'?-Fuzzy-Maße_von_Sugeno']
Sizzle</Sizzle.error
Sizzle</Sizzle.tokenize
jQuery.find

Problem 3

Looks cruel, does not invite for quoting.

Note

T47317#492636 is mentioning sequence of „expanding those UNIQ markers“, „formatHeadings“

Suggestion

  • Reduce the UNIQ stuff to -postMath-0000002A-, omit the delimiting story. Gets still a unique fragment ID in page. Looks better.
  • Numbering of 0000002A might change over time when another formula is inserted above, making the headline a moving target. This goes also for the current ID.
  • The HTML code knows the math expression which creates the UNIQ. If that could be accessed it would be an invariant ID.