Repository navigation
fix(parse): end raw-text tags on a solidus - #21
cursor[bot] wants to merge 1 commit into
Conversation
htmlparser2 only ends script, style, title, textarea, and xmp on ">" or whitespace. A "</script/" end tag therefore stays open and swallows every later tag, so scripts the browser runs are dropped from the result. Co-authored-by: kikohumanbeatbox <kikohumanbeatbox@gmail.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
html-scripts
Details
| Benchmark suite | Current: 76ed901 | Previous: 13370d5 | Ratio |
|---|---|---|---|
getScripts 1MB page |
64.3 ms (64.2-68.8) |
92 ms (90.6-99.3) |
0.70 |
getScripts 20KB page |
87.1 ms (86.6-88.6) |
115.6 ms (114.8-117.7) |
0.75 |
This comment was automatically generated by workflow using github-action-benchmark.
Carried over from #21. htmlparser2 v12 already handles it; this locks it in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Superseded by #22. htmlparser2 v12 ends raw-text end tags on a solidus natively ( |
Bug
</script/is a real script end tag in HTML (the end-tag name may be followed by>, whitespace, or/). htmlparser2 only accepts>and whitespace, andForeignTokenizerinherits that check.A page such as:
loads both scripts in a browser. html-scripts returned only
/app.js. The same hole drops a script that follows</style/,</title/,</textarea/, or</xmp/, and it drops a script written after a breakout inside an inline script (var x = "</script/><script src='/evil.js'>">).Fix
When the raw-text end sequence has matched and the next character is
/, treat it like whitespace so the closing-tag state finishes the tag at the next>.</scripting>is unchanged: the extra letter means it is not an end tag.Validation
standardon the changed files, andava test/index.js(35 tests, including the new solidus cases and the existing script/svg/math suite).