Menu

#246 parsing scripts when there is </SCR'+'IPT> creates tags

open
nobody
5
2007-06-27
2007-06-27
kr0n
No

parsing a page that has scripts such as
document.write('<SCR'+'IPT LANGUAGE=JavaScript ');
document.write('SRC="/ad/728x90/n/j/' + adnum + '/"></SCR'+'IPT>');

parses the </scr'+'ipt> as a valid tag.
even when the STRICT flags is ON

such pages are scripting is popular, this is done to prevent the parser from interpreting the <script> and </script> tags as executable code rather than as a string to be written. Of course depending on the browser.

the created tags are the endtags.

such a page
http://www.fanfiction.net/s/3585614/1/

Discussion

  • Hanh-Missi TRAN

    Hanh-Missi TRAN - 2007-06-28

    Logged In: YES
    user_id=832167
    Originator: NO

    I met the same problem.
    It happens whenever there is a closing tag in the content of the script tag.
    For example, I have in my html page:
    <SCRIPT>
    alert("just a test</test>");
    </SCRIPT>

    Then the output after the parse is:
    <SCRIPT>
    alert("just a test</script></test>");
    </SCRIPT>

     
  • kr0n

    kr0n - 2007-06-28

    Logged In: YES
    user_id=1829758
    Originator: YES

    After I turn off ScriptScanner.STRICT = false; the problem stopped. So it's my bad sorry

     

Log in to post a comment.