Description
Assigning window.location (or iframe.contentWindow.location) to a javascript: URL does not execute the URL's script (consistent with Chromium's camel block of javascript: navigations), but moli additionally leaves location.href in a "ghost" state containing the raw javascript:... string, without navigating. Chromium instead rejects the assignment (href stays unchanged) — and in headless-shell additionally clears the document title.
Steps to Reproduce (moli serve, CDP)
- Navigate to any page.
Runtime.evaluate("window.location='javascript:document.title=\"LOC-RAN\"'").- Read
location.href and document.title.
Actual Behavior (moli, HEAD @ 3cbc3c2)
location.href → "javascript:document.title=\"LOC-RAN\"" (navigation state accepted, script never runs)document.title unchanged; location.reload() in this state loops in place (harmless: no crash, no script execution), and any subsequent real navigation clears the ghost state.<a href="javascript:..."> trusted clicks and iframe src="javascript:..." are likewise no-ops.
Expected / Chromium Baseline (131.0.6778.204 headless-shell)
location.href → stays at the original URL (assignment rejected), so agents reading location.href never see a falsy javascript: string.- Scripts are also not executed (Chromium blocks
javascript: navigation since ~Chrome 65+; subframe and anchor paths are blocked too in 131).
Impact
Low severity, observability only: automation code that trusts location.href as "current page" sees a javascript: string after such an assignment. Suggest normalizing the ghost state (e.g. keep the URL unchanged, or present it as about:blank).
Notes
javascript: execution itself is intentionally absent in moli (only void(0)/void 0/undefined anchor hrefs are treated as inert, moli-renderer-v8/src/native_bridge/element/activation/default_action.rs), so this issue is purely about the state moli leaves behind, not about adding execution.
Description
Assigning
window.location(oriframe.contentWindow.location) to ajavascript:URL does not execute the URL's script (consistent with Chromium's camel block ofjavascript:navigations), but moli additionally leaveslocation.hrefin a "ghost" state containing the rawjavascript:...string, without navigating. Chromium instead rejects the assignment (href stays unchanged) — and in headless-shell additionally clears the document title.Steps to Reproduce (moli serve, CDP)
Runtime.evaluate("window.location='javascript:document.title=\"LOC-RAN\"'").location.hrefanddocument.title.Actual Behavior (moli, HEAD @ 3cbc3c2)
location.href→"javascript:document.title=\"LOC-RAN\""(navigation state accepted, script never runs)document.titleunchanged;location.reload()in this state loops in place (harmless: no crash, no script execution), and any subsequent real navigation clears the ghost state.<a href="javascript:...">trusted clicks andiframe src="javascript:..."are likewise no-ops.Expected / Chromium Baseline (131.0.6778.204 headless-shell)
location.href→ stays at the original URL (assignment rejected), so agents readinglocation.hrefnever see a falsyjavascript:string.javascript:navigation since ~Chrome 65+; subframe and anchor paths are blocked too in 131).Impact
Low severity, observability only: automation code that trusts
location.hrefas "current page" sees ajavascript:string after such an assignment. Suggest normalizing the ghost state (e.g. keep the URL unchanged, or present it asabout:blank).Notes
javascript:execution itself is intentionally absent in moli (onlyvoid(0)/void 0/undefinedanchor hrefs are treated as inert,moli-renderer-v8/src/native_bridge/element/activation/default_action.rs), so this issue is purely about the state moli leaves behind, not about adding execution.