If the HTML title contains character entities, the title bar / tab does not render correctly

[holatuwol]

Expected behaviour

<title>left &amp; right</title> will render as "left & right" in the title bar, no matter how the page is loaded.

Actual behaviour

<title>left &amp; right</title> will render as "left & right" in the title bar, only if the page is loaded directly. It will render as "left & right" if the page is loaded through Senna.js

[eduardolundgren]

This is the native behavior when entities are passed to document.title = '&, more specifically, it happens here. The correct fix is to unescape entities before setting the title in order to behave as when it's unescaped natively by the dom node. The unescape entities implementation is not so trivial since it needs to protects against XSS attacks.

@fernandosouza Could you add to Metal.js an unescapeEntities implementation? Then we can update the code here to use it.

[fernandosouza]

Sure, @eduardolundgren.

[holatuwol]

@eduardolundgren

The specification for the title element says, "Titles may contain character entities (for accented characters, special characters, etc.), but may not contain other markup (including comments)." Is there a reason to retain all of the innerHTML of the title and then introduce the complexity of escaping the character entities?

Additionally, the specification for a title setter says that it should behave as though you set the textContent, so shouldn't the virtual document work the same way?

[eduardolundgren]

@holatuwol You're right, it's unnecessary complexity to unescape entities for that when we can use the title setter to do the job for us After some experiments here, I came to the following conclusion:

1. The correct behavior for when the title is extracted from the HTML parsing is setting through document.getElementsByTagName('title')[0].innerHTML = ' foo &amp; bar <script>alert("hi")</script> '; instead of textContent.
2. Script nodes are not parsed on Chrome, Firefox, Safari (didn't test on IE yet).

@fernandosouza We can prob go with the simpler fix of setting the title in the following way:

var titleElement = document.getElementsByTagName('title')[0];
if (titleElement) {
  titleElement.innerHTML = title;
} else {
  document.title = title;
}

wdyt?

[eduardolundgren]

Fixed on https://github.com/liferay/senna.js/releases/tag/v2.1.3