5 ms·
Any idea if <script> has similar issues? I've always had it in the back of my mind that HTML parsing must have some problems if you mess with the code inside <s
by dataflow 6y ago
Any idea if <script> has similar issues? I've always had it in the back of my mind that HTML parsing must have some problems if you mess with the code inside <script> tags too hard, but I've never gotten motivated enough to try to investigate.
- minitech 6y ago<script> is even more complicated than <style> as far as the HTML spec goes, I think. (There’s parsing weirdness where the behaviour of <!-- in <script> depends on whether </script> followed by --> is present somewhere, for example.) Not sure about whether DOMPurify supports non-executable <script>s.
- dataflow 6y agoOof. I'm not so worried about DOMPurify specifically but I've been thinking surely there's got to be some inconsistency between different browsers or libraries...