title: Why does Java WebStart application refuse to start if JNLP url contains %?
body: <p>I've noticed a curious thing while trying to dynamically generate JNLP files based on URL parameters passed to a HTTP server. If I have something like this in my HTML code, it works:</p>
  
  <pre><code>&lt;embed type="application/x-java-applet;" launchjnlp="dummy.jnlp"/&gt;
  </code></pre>
  
  <p>If on the other hand I have a <code>%</code> character in the <code>launchjnlp</code> attribute, the plugin simply won't do anything:</p>
  
  <pre><code>&lt;embed type="application/x-java-applet;" launchjnlp="dummy%3f.jnlp"/&gt;
  </code></pre>
  
  <p>No error messages, no default Java splash screen, nothing, it silently fails. (Without even attempting to retrieve the JNLP file.)</p>
  
  <p>Is this some kind of security feature? If it is, what is it supposed to guard against?<br>
  Or could it be a straightforward bug?</p>
  
  <p><strong>Update:</strong> Using the <code>&amp;#37;</code> entity instead of a <code>%</code> sign doesn't work either.<br>
  <strong>Update 2:</strong> I tried and failed to find any documentation on the  exact semantics of the <code>launchjnlp</code> attribute, but the entire tag is generated by <a href="https://www.java.com/js/deployJava.txt" rel="nofollow">deployJava.launchWebStartApplication(jnlp)</a>, which is supposedly the "official" way of launching a Web Start application from a browser.<br>
  <strong>Update 3:</strong> Just to be absolutely crystal clear about this: the above example is just that: an example. You can observe the described behaviour with absolutely <strong>any</strong> URL (relative, absolute, file://, http://, you name it), <strong>any</strong> url-encoded character, or even an invalid escape sequence (though in that case it's more or less justified), <strong>the existence or absence of an actual JNLP file is irrelevant</strong>, because we don't even get to the point where the plugin would attempt to load the JNLP file.</p>