If you visit a D8 site as an authenticated user and add a query string parameter which includes a quotation mark, then a JavaScript error will be thrown.

E.g. go to /search?keywords=it's

Error:
Uncaught DOMException: Failed to execute 'querySelectorAll' on 'Document': '[data-drupal-link-system-path="search"]:not([hreflang])[data-drupal-link-query='{"keywords":"it's"}'],[data-drupal-link-system-path="search"][hreflang="en"][data-drupal-link-query='{"keywords":"it's"}']' is not a valid selector.

This does not effect anonymous users as the core/drupal.active-link library is only attached if the current user is authenticated.

If you make a link with an apostrophe-including query like this

Then these are the attributes that the JS in active-link.js need to find

The above can be used as the basis for tests, too.

Issue fork drupal-2902769

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

keeganstreet created an issue. See original summary.

keeganstreet’s picture

StatusFileSize
new701 bytes

This patch escapes single quote characters before passing the string on to be used as input for querySelectorAll.

keeganstreet’s picture

StatusFileSize
new1.49 KB

Patch for 8.4.x with ES6.

keeganstreet’s picture

StatusFileSize
new683 bytes

Previous patch throws error if drupalSettings.path.currentQuery is undefined. This is a new patch for 8.3.x.

keeganstreet’s picture

StatusFileSize
new1.42 KB

Previous 8.4.x patch throws error if drupalSettings.path.currentQuery is undefined. This is a new patch for 8.4.x.

cilefen’s picture

Version: 8.3.x-dev » 8.5.x-dev
Status: Active » Needs review

Hi: we do not expect any more 8.3.x commits except possibly of critical issues.

Status: Needs review » Needs work

The last submitted patch, 5: active_link_js_throws-2902769-5.patch, failed testing. View results

keeganstreet’s picture

keeganstreet’s picture

StatusFileSize
new1.42 KB

That's fine @cilefen, active_link_js_throws-2902769-5.patch applies on 8.4.x and 8.5.x.

keeganstreet’s picture

cilefen’s picture

Status: Needs work » Needs review
droplet’s picture

Status: Needs review » Needs work
Issue tags: +JavaScript, +Needs JavaScript testing

This is a quick fix to mute the error report but will not match the correct query string

The active link contains a bug. Any query string contains `'` or `\` [..more] doesn't match already..

Also,

node?a=1&b=2
node?b=2&a=1

the ordering affected the matching also. However, `node?a=1&b=2` and `node?b=2&a=1` is the same URL in W3C spec, right? (Drupal will give the same result I think)

Also, the [data-drupal-link-query] printed from PHP, we should keep the escape same way. It should not JSON IMO.

wim leers’s picture

This definitely needs JS test coverage.

And we need to keep it in sync with the PHP logic.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

ivrh’s picture

StatusFileSize
new1.45 KB

The patch stopped applying for 8.6.2, so I am re-rolling it against 8.6.x branch

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

amanire’s picture

Issue tags: -JavaScript +JavaScript
StatusFileSize
new1.39 KB

Recognizing the concerns expressed in #12 and #13, but as an interim measure to workaround the errors, this is a reroll of #16 to apply against 8.8.2.

amanire’s picture

StatusFileSize
new1.36 KB

That last reroll in #19 accidentally removed an extra line on active-link.js. Don't use it. Use this one instead.

amanire’s picture

amanire’s picture

StatusFileSize
new1.36 KB

Ugh I think #20 has bad line endings. Again, recognizing the concerns expressed in #12 and #13, but as an interim measure to workaround the errors, this is a reroll of #16 to apply against 8.8.2.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

dmitri.daranuta’s picture

StatusFileSize
new1.45 KB
suresh prabhu parkala’s picture

Status: Needs work » Needs review
StatusFileSize
new1.45 KB
new1.02 KB

Tried to fix custom command failures. Please review.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

agarzola’s picture

StatusFileSize
new1.33 KB

I can confirm that the patch in #27 suppresses the error in 9.1.x. I’m attaching a re-rolled patch against 9.4.x with (I believe) the necessary changes to pass tests.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

needs-review-queue-bot’s picture

Status: Needs review » Needs work
StatusFileSize
new166 bytes

The Needs Review Queue Bot tested this issue. It either no longer applies to Drupal core, or fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.

agarzola’s picture

Status: Needs work » Needs review
StatusFileSize
new668 bytes

Re-rolled against the 10.1.x branch.

agarzola’s picture

StatusFileSize
new1.32 KB

Something caused the previous 9.x patch not to pass tests in 9.5. Tooling in 9.5 causes the non-ES6 version of the file to _not_ get blank lines around the conditional.

This new patch should apply cleanly to 9.5.x.

needs-review-queue-bot’s picture

Status: Needs review » Needs work
StatusFileSize
new107 bytes

The Needs Review Queue Bot tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".

Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.

nod_’s picture

Status: Needs work » Needs review

Branch issue

smustgrave’s picture

Status: Needs review » Needs work
Issue tags: +Needs Review Queue Initiative, +Needs tests, +Needs issue summary update

This issue is being reviewed by the kind folks in Slack, #needs-review-queue-initiative. We are working to keep the size of Needs Review queue [2700+ issues] to around 400 (1 month or less), following Review a patch or merge request as a guide.

As a bug this could use a test case.

Also issue summary should be updated with proposed fix.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

dydave’s picture

StatusFileSize
new580 bytes

Rerolled #34 for 10.2.x.

File /core/misc/active-link.es6.js doesn't seem to exist anymore, so it was removed from the patch.

Please let us know if it moved somewhere and should still be included in the patch.

Thanks in advance !

keshav patel’s picture

Assigned: keeganstreet » Unassigned
Status: Needs work » Needs review
StatusFileSize
new664 bytes

Changed 'const' to 'let', Please Review.

needs-review-queue-bot’s picture

Status: Needs review » Needs work

The Needs Review Queue Bot tested this issue.

While you are making the above changes, we recommend that you convert this patch to a merge request. Merge requests are preferred over patches. Be sure to hide the old patch files as well. (Converting an issue to a merge request without other contributions to the issue will not receive credit.)

jrb’s picture

bnjmnm’s picture

Issue summary: View changes
StatusFileSize
new78.16 KB
new101.82 KB

#12 and #13 both point out that the approach of simply removing the apostrophe is not sufficient. It eliminates the JS error, but it doesn't result in the active link JS working properly as the query it builds will not match the correct link.

utkarsh_33’s picture

I debugged this for a while and here are some points that i observed:-
1)$generated_link = $link_generator->generate($element['#title'], $element['#url']->setOptions($options)); in
Link.php is called twice for the link.For the first time it get the wrong element without the data drupal selectors but it does not attach that to the markup(which is on the next line).For the second time when this is called again $element['url']->setOption('set_active_class', TRUE); sets the class to true which inturn sets the correct data attributes to the element and then attaches it to the mark-up in $element['#markup'] = $generated_link; in Link.php.
2)With the correct element set at the PHP side It still does not correctly render the element in the markup.

Just wanted to confirm if I am on the right track of figuring out what could be the issue?

bnjmnm’s picture

Re #45
The way PHP renders the links and their attributes is fine. This was correctly reported as a JavaScript issue and that's where the solution will be.

The specific issue is JavaScript is not adequately finding those links when they use special characters. If the JS query string escapes special characters in the same way PHP does, then it will get a match and work properly.

Use the steps in #44 to make a link that will reproduce the problem as reported, and the solution is modifying the JS. In fact The solution will likely be modifying the same line as the prior patches, but instead of just removing special characters, it converts it to the encoding that allows it to match the expected link and add the "is active" class.

socialnicheguru’s picture

nayana_mvr made their first commit to this issue’s fork.

nayana_mvr’s picture

Status: Needs work » Needs review

The fix for the ticket mentioned in #47 fixes the issue mentioned in this ticket as well. I applied the changes of that ticket in Drupal 11.0.x and it fixed the js error mentioned here. I didn't verify that initially that’s why I added a commit into the MR here. Maybe someone else can also verify it once so moving it to Needs Review.

nayana_mvr’s picture

StatusFileSize
new561.18 KB
new460.93 KB

Attaching screenshots fas evidence.

Before:

before

After:

after

smustgrave’s picture

Status: Needs review » Needs work

Please read the tags and pipeline status before putting into review.

nayana_mvr’s picture

This issue is not reproducible in Drupal 11.x. Verified it with fresh Drupal 11.x setup. Attaching SS for reference.

fixed

Please check my previous comment where I have mentioned the same #49. I think this ticket can be closed since it is already fixed along with https://www.drupal.org/project/drupal/issues/3464340. I moved it to Needs Review so that someone else can also verify it once.

nayana_mvr’s picture

StatusFileSize
new302.97 KB
mohammedodeh’s picture

StatusFileSize
new670 bytes

Reroll the patch to version 10.4.2

matthijs’s picture

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

scott_euser’s picture

Trying to remove the usage of currentQuery altogether here #3620504: Stop relying on drupalSettings.path.currentQuery, read from window.location instead which should solve this issue here as well. I added test coverage into that one that covers special characters