Browsers treat vertical tab characters in input type=text differently. Is one of them correct?

Question

In developing some server side validation I discovered that (the latest Windows versions as of this writing of) Firefox, Chrome and Internet Explorer handle vertical tab characters differently in input type=text form fields.

I had a hard time trying to paste the character into any of the browsers so I used JavaScript to populate the text input on my test form like this:

document.getElementById('theField').setAttribute('value', "hello\vthere");

You can see some of the client side differences in this JSFiddle.

There are differences in how the browsers:

• display the value in the input field.
• allow JavaScript to fetch the value back out
• render the character when used to populate innerHTML of a <pre> tag
• send the value to the server.

This table below shows what I found:

Browser    | displayed   | put into pre-tag | logged to console | received by server
------------------------------------------------------------------------------------
Chrome     | hello       | hellothere       | hellothere        | hello
------------------------------------------------------------------------------------
Safari     | hello       | hellothere       | hellothere        | hello
------------------------------------------------------------------------------------
Firefox    | hellothere  | hellothere       | hellothere        | hello
  FF cont. |             |                  |                   |      there
------------------------------------------------------------------------------------
IE         | hello there | hello there      | hello             | hello
  IE cont. |             |                  |   there           |      there
------------------------------------------------------------------------------------
Opera      | hellothere  | hello            | hello             | hello
  Op cont. |             | there            | there             |      there

For the console I used each browser's built in developer tools (I couldn't get the JSFiddle to work with Firebug).

Is there a specification on how browsers are supposed to handle this character in this type of form field? If so what is the specification and which browser is following it?

Answer 1

Updated Answer

tkent, a chromium developer who worked to resolve that browser's value truncation issue, found WHATWG specifications stating that the Vertical Tab (U+000B) is legal and should be unmodified in various contexts. Pertinent to this question on input type=text is the following:

http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#attribute-value-(double-quoted)-state

VT characters is in "Anything else." It is appended to an attribute value as is.

The above is excerpted from his original comment on the chromium issue tracker.

Original Answer I couldn't find an HTML or HTTP specification that specifically disallows the vertical tab in form input values. But based on indirect information Firefox, I.E. and Opera appear to be more correct.

The input value can be thought of as an element attribute value in which case it falls under the definition of an attribute value. The HTML5 draft spec. says that attribute values "are a mixture of text and character references, except with the additional restriction that the text cannot contain an ambiguous ampersand."

Their definitions of "text" and "character references" don't specifically exclude the vertical tab . By my reading this suggests that it is allowed.

Also, chromium developers have agreed that this is an issue and are working to address it.

Answer 2

I'd say, the vertical tab character is one of the classic ASCII whitespace characters (Unicode e.g. knows some more), so HTML should "collapse" it to a single space in normal text (white-space: normal).

From a Python commandline session:

>>> import string
>>> string.whitespace
'\t\n\x0b\x0c\r '
>>> string.whitespace == '\t\n\v\f\r '
True
>>> map(ord, '\t\n\v\f\r ')
[9, 10, 11, 12, 13, 32]

Browsers might not know what to do about the vertical tab ('\v') because it is seldom used these days; I reckon it had more importance in the times of non-graphical printers with fixed-width character sets. But it is a legal character (even if not easily entered, which is true for the "normal" tab character in web forms as well), so it should be stored and transmitted like any else.