22233 2013-06-02 12:57:23 +0000 [HTML]: I can't find the rules which specify real-world parsing of <body><script>& 2013-06-07 13:29:34 +0000 1 1 1 Unclassified HTML WG HTML5 spec unspecified PC Linux RESOLVED INVALID P2 normal --- 1 alan.christopher.jenkins dave.null bzbarsky hsivonen mike public-html-admin public-html-wg-issue-tracking public-html-bugzilla oldest_to_newest 88549 0 alan.christopher.jenkins 2013-06-02 12:57:23 +0000 AFAICS the tokenizer is only switched to "script data state" from the "in head" insertion mode. However real-world browsers also switch to "script data state" from <script> inside <body>. E.g. Firefox 21.0 with this test page: <!doctype html> <body> <script>alert('&')</script> The result is "&". But AFAICS the spec implies this (non-conforming) page should result in "&". (Which violates the principle of least surprise, at least). My understanding was that this was the real-world behaviour on all major browsers. And if the spec is in variation then no major browser is conforming, which is an obstacle to standardization. Am I right about the behaviour specified by HTML5? And major browsers other than Firefox? If so, does the spec need to be changed? This thought was provoked after looking at how <svg><script> works in HTML syntax. http://security.stackexchange.com/questions/36701/why-does-this-xss-vector-work-in-svg-but-not-in-html I recently came across this particular tag soup in ci-Bonfire. Example page http://eposure.com/ 88904 1 hsivonen 2013-06-07 13:29:34 +0000 "In body" says: > A start tag token whose tag name is one of: "base", "basefont", "bgsound", "link", "meta", "noframes", "script", "style", "title" > > Process the token using the rules for the "in head" insertion mode.