html: escape text that would close its containing raw text element - #255
Open
adilburaksen wants to merge 1 commit into
Open
html: escape text that would close its containing raw text element#255adilburaksen wants to merge 1 commit into
adilburaksen wants to merge 1 commit into
Conversation
Contributor
|
This PR (HEAD: 1367502) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/net/+/809240. Important tips:
|
childTextNodesAreLiteral reports that the text children of script, style, xmp, iframe, noembed, noframes, noscript and plaintext are to be written out literally. That is correct for text produced by the tokenizer in raw text mode, which cannot contain an end tag for its own element: the tokenizer would have closed the element rather than produce it. noscript is different. When a document is parsed with scripting disabled, the parser descends into noscript and decodes character references in its contents, so the resulting text node can hold arbitrary markup, including "</noscript>". Rendering that literally lets the text close the element and be re-parsed as live nodes: in: <body><noscript></noscript><img src=x></noscript> out: <body><noscript></noscript><img src=x></noscript></body> The parse tree contains no img element; the rendered output does. Callers that parse untrusted HTML, decide what is safe by walking the tree, and re-serialize with Render -- the sequence the package documentation recommends for security contexts -- emit an element they never approved. Escape a literal text child when it would otherwise close its containing element. The predicate mirrors the tokenizer's readRawEndTag: "</" plus the tag name matched ASCII case-insensitively, followed by a tag-name terminator. For text produced by the tokenizer this never triggers, so rendering is unchanged. plaintext and script are excluded. plaintext has no end tag; it consumes the rest of the input, so no text can close it. script follows the script data escaping rules in readScript, under which an embedded "</script>" does not always close the element, so its text can legitimately contain one and must still be written literally -- html5lib-tests tests16.dat case 168 covers this.
adilburaksen
force-pushed
the
html-escape-raw-text-end-tag
branch
from
August 2, 2026 19:44
1367502 to
488eb41
Compare
Contributor
|
Message from Gopher Robot: Patch Set 1: (1 comment) Please don’t reply on this GitHub thread. Visit golang.org/cl/809240. |
Contributor
|
This PR (HEAD: 488eb41) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/net/+/809240. Important tips:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
childTextNodesAreLiteral reports that the text children of script, style,
xmp, iframe, noembed, noframes, noscript and plaintext are to be written
out literally. That is correct for text produced by the tokenizer in raw
text mode, which cannot contain an end tag for its own element: the
tokenizer would have closed the element rather than produce it.
noscript is different. When a document is parsed with scripting disabled,
the parser descends into noscript and decodes character references in its
contents, so the resulting text node can hold arbitrary markup, including
"". Rendering that literally lets the text close the element
and be re-parsed as live nodes:
The parse tree contains no img element; the rendered output does. Callers
that parse untrusted HTML, decide what is safe by walking the tree, and
re-serialize with Render -- the sequence the package documentation
recommends for security contexts -- emit an element they never approved.
Escape a literal text child when it would otherwise close its containing
element. The predicate mirrors the tokenizer's readRawEndTag: "</" plus
the tag name matched ASCII case-insensitively, followed by a tag-name
terminator. For text produced by the tokenizer this never triggers, so
rendering is unchanged.
plaintext and script are excluded. plaintext has no end tag; it consumes
the rest of the input, so no text can close it. script follows the script
data escaping rules in readScript, under which an embedded "</script>"
does not always close the element, so its text can legitimately contain
one and must still be written literally -- html5lib-tests tests16.dat
case 168 covers this.