php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #31493 navigating to javascript:anything kills IE
Submitted: 2005-01-11 16:58 UTC Modified: 2005-03-21 01:41 UTC
From: csaba at alum dot mit dot edu Assigned:
Status: Not a bug Package: COM related
PHP Version: 5.0.3 OS: Win XP Pro
Private report: No CVE-ID: None
 [2005-01-11 16:58 UTC] csaba at alum dot mit dot edu
Description:
------------
If I do
$ie = new COM("InternetExplorer.Application"); 
$nav = "javascript:alert('hi mom');";
$ie->Navigate($nav); 

IE vanishes, but fast

Note, this is run using PHP.exe (CLI) from a CMD box
on a Win XP Pro SP2 machine with IE 6

Thanks,
Csaba Gabor from Vienna

Reproduce code:
---------------
<?php 
$ie = new COM("InternetExplorer.Application"); 
$ie->Visible = true; 
$nav = "javascript:document.open();document.write('<body onload=\"alert(\\'Ready\\')\">Hi mom</body>');document.close();";
print "$nav\n";
sleep(3);
$ie->Navigate($nav); 
sleep(5);
print "finished!\n"; 
?>


Expected result:
----------------
I expect to see a browser which displays a 'Ready' alert box and 'Hi Mom' in the browser window.

Actual result:
--------------
As soon as the $ie->Navigate is called, the bell clinks and IE is gone.  The PHP program continues to run without error.

It doesn't seem to matter what is after the javascript:
It could be as simple as
$nav = "javascript:alert('hi mom');";
or you could get rid of the onload part from $nav in the example I supplied.
By the way, you can see that IE accepts $nav directly just fine (but get rid of the backslashes except one each before the inner single quotes, and of course remove the first " and the trailing ";  -  In other words, use what is printed to the CMD screen) by manually copying it in to the location bar and pressing enter yourself.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-01-13 21:09 UTC] derick@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.0-win32-latest.zip

It's a COM issue... should be fixed in the snapshot

 [2005-01-14 00:19 UTC] csaba at alum dot mit dot edu
Thanks for looking into this.  I downloaded and just now
tested with the 13 Jan 04 PHP version 5.0.4.dev
and regretably the problem is still there (though I
replaced all the files, I did not reboot my PC, however).

To ensure it's not a quoting situation, I also tested with:
$nav = "javascript:alert(7);";

Csaba
 [2005-01-14 09:09 UTC] derick@php.net
Reboot... windows sometimes caches DLLs.
 [2005-01-14 10:33 UTC] csaba at alum dot mit dot edu
Fair enough.  I have just now rebooted, then downloaded and installed PHP ver 5.0.4-dev (cli) (built Jan 14 2005 02:20:54).

Still the same problem.  IE goes away (and rings a bell) as soon as the Navigate is hit.
 [2005-01-15 17:35 UTC] derick@php.net
You ofcourse need to reboot AFTER you installed it...
 [2005-01-17 04:02 UTC] csaba at alum dot mit dot edu
As a double check, I downloaded, then installed, PHP ver 5.0.4-dev (cli) (built Jan 17 2005 02:30:00).

Still the same problem.  IE goes away (and rings a bell) as soon as the Navigate is hit.
 [2005-01-17 04:32 UTC] wez@php.net
You should never call sleep() in a script that uses COM, as deadlocks and bad mojo can result.  Instead, use com_message_pump() and specify your delay in milliseconds.

If that doesn't help any, I'll try to look into this problem later in the week.
 [2005-01-17 07:46 UTC] csaba at alum dot mit dot edu
I have replaced the sleep(...) with appropriate com_message_pump(...), but I still get the same results.
 [2005-02-28 21:09 UTC] sniper@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip


 [2005-03-09 01:40 UTC] csaba at alum dot mit dot edu
I have tried this with the March 7 build and it is still not working in the same fashion, but I have a bit more information on it.  It is tied to the fact that there is no previous navigation before the javascript:whatever is hit.

For example,
<?php
$ie = new COM("InternetExplorer.Application"); 
//$nav = "javascript:'<body>Hi Mom</body>'";
$nav = "javascript:alert('Hi Mom')";
$ie->Visible = true;
$ie->Navigate($nav); 
?>

will vanish IE, but

<?php
$ie = new COM("InternetExplorer.Application"); 
//$nav = "javascript:'<body>Hi Mom</body>'";
$nav = "javascript:alert('Hi Mom')";
$ie->Visible = true;
$ie->Navigate("about:blank");
$ie->Navigate($nav); 
?>

will keep IE around (you can also use the non alert version).  The point is that the 'pre navigation' to "about:blank" allows the main navigation to go through somehow.
 [2005-03-10 00:59 UTC] csaba at alum dot mit dot edu
Sorry to reopen this, but I wanted to ensure that this got attention.  I'm not objecting to it being closed, per se, but I don't think it makes sense to do so without a comment considering that the penultimate comment says, "Is it working", and the response is "No."  Anybody looking at this in the future (and me looking at it now) is going to wonder what went on.

It would be good to know whether this is not considered a bug (or is of the 'not our problem' variety), is a Won't fix situation, or possibly confused with bug 31492 (since that seems to have already happened once, but that bug is distinct), or what?  But in my most recent testing, the original scenario still failed.

Csaba
 [2005-03-18 19:49 UTC] sniper@php.net
And with 'original scenario' you mean what? The first example script in this report? (with the sleep() call?) Or what?

 [2005-03-18 23:30 UTC] csaba at alum dot mit dot edu
<?php
$ie = new COM("InternetExplorer.Application"); 
$ie->Visible = true;
$nav = "javascript:alert('hi mom');";
$ie->Navigate($nav);
?>

Fair enough.  I mean in the code above IE will vanish and not put up the alert.  If, on the other hand, you put the following line into IE's address bar, IE will put up the expected alert and not vanish:
javascript:alert('hi mom');
 [2005-03-20 23:14 UTC] sniper@php.net
If IE crashes / doesn't do something, how is it PHP bug? Bogus.

 [2005-03-21 01:41 UTC] csaba at alum dot mit dot edu
I could only report an observed behaviour.  Whether or not the problem lay with PHP is something I couldn't answer.  But since entering the 'uri' manually worked, it was reasonable to report.

For the record, here is the workaround I have found.  You should add a single line, to navigate to about:blank before navigating to a javascript:protocol.  The following will not crash IE:

<?php
$ie = new COM("InternetExplorer.Application");
$ie->Navigate("about:blank"); 
$ie->Visible = true;
$nav = "javascript:alert('hi mom');";
$ie->Navigate($nav);
?>
 
PHP Copyright © 2001-2022 The PHP Group
All rights reserved.
Last updated: Tue Nov 29 14:04:16 2022 UTC