Skip to content

Improve script tag escaping? #150

@pelme

Description

@pelme

https://jameshfisher.com/2024/04/24/how-to-escape-javascript-for-a-script-tag/ describes how <script> tags does not follow the regular HTML parsing semantics. htpy uses the same kind of escaping for script tags and other tags.

https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements says

The easiest and safest way to avoid the rather strange restrictions described in this section is to always escape an ASCII case-insensitive match for "<!--" as "\x3C!--", "<script" as "\x3Cscript", and "</script" as "\x3C/script" when these sequences appear in literals in scripts (e.g. in strings, regular expressions, or comments), and to avoid writing code that uses such constructs in expressions. Doing so avoids the pitfalls that the restrictions in this section are prone to triggering: namely, that, for historical reasons, parsing of script blocks in HTML is a strange and exotic practice that acts unintuitively in the face of these sequences.

would that be a good, universal solution?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions