Maximum call stack size exceeded when query string param contains single quote/apostrophe

[daviferreira]

I'm submitting a ...

• bug report
• feature request
• other

Current behavior:
When you have a single quote as a value for a query string param, angular-ui-router goes into an infinite loop.

Expected / new behavior:
Single quotes should work fine as query string params.

Minimal reproduction of the problem with instructions:

https://plnkr.co/edit/B2uRltFHZd4IP8XcHlTd?p=preview

(enter a single quote in the search field and click search and check the console - note that your browser/tab might become unresponsive)

AngularJS version: 1.7.0
(works fine on 1.6.x)

Browser: all

Anything else:

angular.js:14996 RangeError: Maximum call stack size exceeded
    at m.$digest (angular.js:18537)
    at angular.js:14776
    at angular.js:6659
    at q (angular.js:374)
    at tg.k [as $$checkUrlChange] (angular.js:6658)
    at m.$digest (angular.js:18625)
    at angular.js:14776
    at angular.js:6659
    at q (angular.js:374)
    at tg.k [as $$checkUrlChange] (angular.js:6658)
(anonymous) @ angular.js:14996
(anonymous) @ angular.js:11280
$apply @ angular.js:18925
(anonymous) @ angular.js:28069
lg @ angular.js:3780
d @ angular.js:3768

[petebacondarwin]

Since this is sitting on top of ui-router, which is a 3rd party library, I would ask that you check with them that it is not an issue with that library first. You can prove it is not by providing a reproduction that doesn't include ui-router.

At first sight I wonder if you should be responsible for encoding queries before passing them as params?

[daviferreira]

Since the stack trace had no reference to ui-router and since it used to work on previous versions of Angular, I just assumed it was an issue here. But I will try to reproduce it without ui-router, thanks!

[daviferreira]

Here is a reproduction with angular only, using the router example from the docs:

https://plnkr.co/edit/YAht5awDIZuLmMuyv1vj?p=preview

Happens with both normal (') and encoded (%27).

[pioug]

I am facing this issue too! I think it's similar to what's reported in #16100 and it could be solved by this commit jbedard@b0e5ac6.

[petebacondarwin]

I think that @pioug is right. We should see if we can get @jbedard's branch landed.

[CarterLi]

This issue is preventing us from upgrading angularjs to 1.7. Please fix it

[jbedard]

Anyone have an example of how this could be reproduced in a unit test?

[daviferreira]

Not really, but if you go to angular docs you can also reproduce it.

https://docs.angularjs.org/api/?q=%27foo%27

[jbedard]

Some notes:

• $browser and $location manage the URLs a bit differently causing this comparison to consistently detect changes. That is the main source of this bug.
• $browser.url() returns the location.href directly which allows the browser to normalize the URL. However until 1.7 $browser did unescape quotes (but nothing else, and it was flagged as a FF-only workaround).
• $location.absUrl() returns a manually created url which uses custom encoding methods for the path, params and hash
• $browser persists a non-normalized url which may cause other url comparison issues
• fix($browser): normalize inputted URLs #16606 persists that url (^) in a normalized state which seems to fix some cases, but I still have test cases it doesn't seem to fix