mshtml: Unescape script from javascript: URLs before executing them.

dlls/mshtml/navigate.c

@@ -1789,6 +1789,12 @@ static void navigate_javascript_proc(task_t *_task)
     if(FAILED(hres))
         return;
 
+    hres = UrlUnescapeW(code, NULL, NULL, URL_UNESCAPE_INPLACE);
+    if(FAILED(hres)) {
+        SysFreeString(code);
+        return;
+    }
+
     set_download_state(window->doc_obj, 1);
 
     V_VT(&v) = VT_EMPTY;

dlls/mshtml/tests/htmldoc.c

@@ -6874,7 +6874,7 @@ static void test_HTMLDocument_http(BOOL with_wbapp)
         test_put_href(doc, FALSE, "#test", "http://www.winehq.org/#test", FALSE, TRUE, 0);
         test_travellog(doc);
     }
-    test_put_href(doc, FALSE, NULL, "javascript:external&&undefined", TRUE, FALSE, 0);
+    test_put_href(doc, FALSE, NULL, "javascript:external%20&&undefined", TRUE, FALSE, 0);
     test_put_href(doc, FALSE, NULL, "about:blank", FALSE, FALSE, support_wbapp ? DWL_EXPECT_HISTUPDATE : 0);
     test_put_href(doc, TRUE, NULL, "about:replace", FALSE, FALSE, 0);