CDATA Escapes - Revision history

Annevk: removed Category:Proposals using HotCat

2014-09-28T06:15:24Z

← Older revision		Revision as of 06:15, 28 September 2014
Line 230:		Line 230:

	The heuristic doesn't attempt to detect single or double quotes appearing inside a regular expression literal, because detecting regular expression literals properly is complicated and it's unlikely that </script> would appear in a string literal on the same line with such a regular expression. (I'm assuming the inline minified JS with a minifier that can't escape </script> is a non-issue. '''This assumption was very bad and makes the whole thing fail.''')		The heuristic doesn't attempt to detect single or double quotes appearing inside a regular expression literal, because detecting regular expression literals properly is complicated and it's unlikely that </script> would appear in a string literal on the same line with such a regular expression. (I'm assuming the inline minified JS with a minifier that can't escape </script> is a non-issue. '''This assumption was very bad and makes the whole thing fail.''')

	~~[[Category:Proposals]]~~

Annevk at 06:15, 28 September 2014

2014-09-28T06:15:16Z

← Older revision		Revision as of 06:15, 28 September 2014
Line 1:		Line 1:
			{{obsolete\|spec=[https://html.spec.whatwg.org/multipage/syntax.html#tokenization HTML: Tokenization]}}

	==Requirements==		==Requirements==

GPHemsley: added Category:Proposals using HotCat

2013-07-09T14:28:39Z

added Category:Proposals using HotCat

← Older revision		Revision as of 14:28, 9 July 2013
Line 228:		Line 228:

	The heuristic doesn't attempt to detect single or double quotes appearing inside a regular expression literal, because detecting regular expression literals properly is complicated and it's unlikely that </script> would appear in a string literal on the same line with such a regular expression. (I'm assuming the inline minified JS with a minifier that can't escape </script> is a non-issue. '''This assumption was very bad and makes the whole thing fail.''')		The heuristic doesn't attempt to detect single or double quotes appearing inside a regular expression literal, because detecting regular expression literals properly is complicated and it's unlikely that </script> would appear in a string literal on the same line with such a regular expression. (I'm assuming the inline minified JS with a minifier that can't escape </script> is a non-issue. '''This assumption was very bad and makes the whole thing fail.''')

			[[Category:Proposals]]

Zcorpan: /* Proposal #3 */

2010-03-26T10:58:02Z

Proposal #3

← Older revision		Revision as of 10:58, 26 March 2010
Line 68:		Line 68:

	* www.jeuxactu.com/images-fiche-soul-calibur-legends-8219-4-6.html		* www.jeuxactu.com/images-fiche-soul-calibur-legends-8219-4-6.html

			Also see http://lists.w3.org/Archives/Public/public-html/2009Oct/0146.html

	=== Proposal adopted ===		=== Proposal adopted ===

Zcorpan: /* Proposal #3 */

2010-03-26T10:55:16Z

Proposal #3

@@ Line 41: / Line 41: @@
 * Maybe remove &lt;!-- ... --> escapes from style, title, textarea and xmp. (I think only script needs it.)
-** Need to investigate whether this helps or hurts pages.
+** Need to investigate whether this helps or hurts pages. [http://lists.w3.org/Archives/Public/public-html/2009Oct/0910.html Done].
 * For script, when in an escaped text span, set a flag after having seen "<script". "</script" followed by whitespace or slash or greater-than only closes the element if the flag is not set, and otherwise emits the text and resets the flag. Exiting an escaped text span also resets the flag.
@@ Line 68: / Line 68: @@
 * www.jeuxactu.com/images-fiche-soul-calibur-legends-8219-4-6.html
 ==Proposal #2 (FAIL)==

Zcorpan: /* Proposal #3 */

2009-10-06T08:31:12Z

Proposal #3

← Older revision		Revision as of 08:31, 6 October 2009
Line 42:		Line 42:
	* Maybe remove <!-- ... --> escapes from style, title, textarea and xmp. (I think only script needs it.)		* Maybe remove <!-- ... --> escapes from style, title, textarea and xmp. (I think only script needs it.)
	** Need to investigate whether this helps or hurts pages.		** Need to investigate whether this helps or hurts pages.
	* For script, when in an escaped text span, set a flag after having seen "<script" ~~followed by whitespace or slash or greater-than~~. "</script" followed by whitespace or slash or greater-than only closes the element if the flag is not set, and otherwise emits the text and resets the flag. Exiting an escaped text span also resets the flag.		* For script, when in an escaped text span, set a flag after having seen "<script". "</script" followed by whitespace or slash or greater-than only closes the element if the flag is not set, and otherwise emits the text and resets the flag. Exiting an escaped text span also resets the flag.

	This proposal would fail for		This proposal would fail for

Zcorpan: /* Proposal #3 */

2009-10-05T16:17:33Z

Proposal #3

← Older revision		Revision as of 16:17, 5 October 2009
Line 42:		Line 42:
	* Maybe remove <!-- ... --> escapes from style, title, textarea and xmp. (I think only script needs it.)		* Maybe remove <!-- ... --> escapes from style, title, textarea and xmp. (I think only script needs it.)
	** Need to investigate whether this helps or hurts pages.		** Need to investigate whether this helps or hurts pages.
	* For script, when in an escaped text span, set a flag after having seen "<script" followed by whitespace or slash or greater-than. "</script" followed by whitespace or slash or greater-than only closes the element if the flag is not set, and otherwise emits the text and resets the flag.		* For script, when in an escaped text span, set a flag after having seen "<script" followed by whitespace or slash or greater-than. "</script" followed by whitespace or slash or greater-than only closes the element if the flag is not set, and otherwise emits the text and resets the flag. Exiting an escaped text span also resets the flag.

	This proposal would fail for		This proposal would fail for
Line 55:		Line 55:
	* www.celebrity-link.com/c106/showcelebrity_categoryid-10687.html		* www.celebrity-link.com/c106/showcelebrity_categoryid-10687.html
	* me.yaplog.jp/viewBoard.blog?boardId=975		* me.yaplog.jp/viewBoard.blog?boardId=975

	~~Is the above enough to declare this proposal as a FAIL? Maybe the idea in proposal #4 can be integrated in this proposal to solve the above pattern?~~

	This proposal would also fail for		This proposal would also fail for

	<script>		<script>
	~~var x = '~~<!--';		<!--
	~~var y =~~ '<script>';		document.write('<script></scr'+'ipt>');
	</script>		</script>

	~~Are~~ there ~~any pages~~ doing ~~that~~, ~~though?~~		This pattern also breaks with what is currently specced, though.

			http://philip.html5.org/data/script-open-in-escape.txt shows that there is one site doing the above, e.g.

			* www.jeuxactu.com/images-fiche-soul-calibur-legends-8219-4-6.html

	==Proposal #2 (FAIL)==		==Proposal #2 (FAIL)==

Zcorpan: /* Proposal #4 (FAIL) */

2009-10-01T08:51:00Z

Proposal #4 (FAIL)

← Older revision		Revision as of 08:51, 1 October 2009
Line 20:		Line 20:
	==Proposal #4 (FAIL)==		==Proposal #4 (FAIL)==

	* For script, let document.write\s*( start an escaped text span, and let ) end it. Inside the escaped text span, </script does not close the element.		* For script, let document.write\s( and document.writeln\s( start an escaped text span, and let ) end it. Inside the escaped text span, </script does not close the element.

	This proposal would break for		This proposal would break for

Zcorpan: /* Proposal #3 */

2009-09-30T22:42:12Z

Proposal #3

← Older revision		Revision as of 22:42, 30 September 2009
Line 56:		Line 56:
	* me.yaplog.jp/viewBoard.blog?boardId=975		* me.yaplog.jp/viewBoard.blog?boardId=975

	Is the above enough to declare this proposal as a FAIL?		Is the above enough to declare this proposal as a FAIL? Maybe the idea in proposal #4 can be integrated in this proposal to solve the above pattern?

	This proposal would also fail for		This proposal would also fail for

Zcorpan: /* Proposal #4 */

2009-09-30T22:41:19Z

Proposal #4

← Older revision		Revision as of 22:41, 30 September 2009
Line 18:		Line 18:
	* It would be nice for the rest of the page not to get eaten up when the author omits </title> accidentally or mistypes it as <title>.		* It would be nice for the rest of the page not to get eaten up when the author omits </title> accidentally or mistypes it as <title>.

	==Proposal #4==		==Proposal #4 (FAIL)==

	* For script, let document.write\s*( start an escaped text span, and let ) end it. Inside the escaped text span, </script does not close the element.		* For script, let document.write\s*( start an escaped text span, and let ) end it. Inside the escaped text span, </script does not close the element.
Line 29:		Line 29:
	//--></script>		//--></script>

	~~Are there any pages doing~~ the above ~~though?~~		This proposal would also break for

			<script><!--
			var w = document.write;
			w("<script></script>");
			//--></script>

			Without researching, I suspect that the two patterns above are very common.

	==Proposal #3==		==Proposal #3==