12398 2011-03-30 00:52:49 +0000 Tokenizer stuck in ScriptDataDoubleEscapedState 2011-08-04 05:34:11 +0000 1 1 1 Unclassified HTML WG LC1 HTML5 spec unspecified All All RESOLVED WONTFIX P1 critical --- 1 tonyg ian bzbarsky gregsimon hsivonen ian james mike public-html-admin public-html-wg-issue-tracking w3c public-html-bugzilla oldest_to_newest 47038 0 972 tonyg 2011-03-30 00:52:49 +0000 Created attachment 972 Testcase The attached test case gets stuck in ScriptDataDoubleEscapedState which seems incorrect. IE7-9: PASS SF5: PASS OP11: PASS FF3.6: PASS FF4: FAIL CR10-12: FAIL Filed in WebKit as https://bugs.webkit.org/show_bug.cgi?id=57407 47039 1 w3c 2011-03-30 01:00:20 +0000 Note: This bug affects Bugzilla, so be careful copy/pasting the string around in this page or you might hose the bug. 47041 2 tonyg 2011-03-30 01:24:37 +0000 Actually the title of this bug is misleading, the "</script>" gets us out of ScriptDataDoubleEscapedState and back into ScriptDataEscapedState. I'm still looking into it, but maybe the bug is that we shouldn't go into ScriptDataDoubleEscapedState in the first place. 47045 3 hsivonen 2011-03-30 06:17:07 +0000 It's known that there exists some sites on the Web where the spec gets stuck inside a script. That's the price of never reparsing. Is this breaking a top site that you have been unable to evangelize? With Firefox, the script states have been a wild success beyond my expectations. Exactly one case of site breakage has reached me on b.m.o and that site was successfully evangelized. With the data presented so far, I'd WONTFIX this. To the extent this affects Bugzilla itself, it's a bug in Bugzilla, although I thought the bug was already fixed in upstream Bugzilla. In general, any Web app that includes untrusted strings as string literals in inline scripts MUST escape < as \u003C to be safe. (That's the simplest way to deal with <!--, <script> and </script> all in one go.) 47046 4 hsivonen 2011-03-30 06:19:38 +0000 Also note that you'll never get all possible cases "right" without including JavaScript and VBScript parsers as part of the HTML tokenizer, so it's kinda useless to be able to point to one more case that "fails". 47047 5 w3c 2011-03-30 06:43:26 +0000 Tony probably knows more of the details, but my understanding is that this issue manifests itself in one of Google's web site. We can certainly ask those folks if they'd be willing to work around the issue. 47049 6 hsivonen 2011-03-30 09:41:30 +0000 (In reply to comment #5) > Tony probably knows more of the details, but my understanding is that this > issue manifests itself in one of Google's web site. We can certainly ask those > folks if they'd be willing to work around the issue. In that case, I think this should be WONTFIX+evang. 47050 7 zcorpan 2011-03-30 10:03:42 +0000 I agree that this should be WONTFIX. The current spec is as web compatible as it gets without doing reparsing. 47057 8 tonyg 2011-03-30 16:21:31 +0000 Thanks for the explanations. I've mentioned your escaping suggestion to the webmaster. Does anyone have a bugzilla contact to do the same? 47068 9 hsivonen 2011-03-31 05:44:38 +0000 I believe the Bugzilla bug was https://bugzilla.mozilla.org/show_bug.cgi?id=503980 Is there still another bug of that nature in Bugzilla itself? 49451 10 ian 2011-06-10 22:24:59 +0000 Note that a Web page that runs into this will be invalid, so authors can avoid this problem by using the validator to check their pages. EDITOR'S RESPONSE: This is an Editor's Response to your comment. If you are satisfied with this response, please change the state of this bug to CLOSED. If you have additional information and would like the editor to reconsider, please reopen this bug. If you would like to escalate the issue to the full HTML Working Group, please add the TrackerRequest keyword to this bug, and suggest title and text for the tracker issue; or you may create a tracker issue yourself, if you are able to do so. For more details, see this document: http://dev.w3.org/html5/decision-policy/decision-policy.html Status: Rejected Change Description: no spec change Rationale: per comments above 53888 11 mike 2011-08-04 05:34:11 +0000 mass-move component to LC1 972 2011-03-30 00:52:49 +0000 2011-03-30 00:52:49 +0000 Testcase comment.html text/html 333 tonyg PCFET0NUWVBFIGh0bWw+CjwhLS0gc2F2ZWQgZnJvbSB1cmw9KDAwNDYpaHR0cDovL3d3dy5jb3Jw Lmdvb2dsZS5jb20vfnRvbnlnL2NvbW1lbnQuaHRtbCAtLT4KPGh0bWw+PGhlYWQ+PG1ldGEgaHR0 cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9SVNPLTg4 NTktMSI+PC9oZWFkPjxib2R5PjxkaXYgaWQ9Im91dHB1dCI+RkFJTDwvZGl2Pgo8c2NyaXB0PnZh ciBhID0gIjwhLS08c2NyaXB0ICI7ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ291dHB1dCcpLmlu bmVySFRNTD0nUEFTUyc7PC9zY3JpcHQ+Cjwvc2NyaXB0PjwvYm9keT48L2h0bWw+