A `<` in a sript tag brings everything to a grinding halt. about sax-js HOT 7 CLOSED

Ah, <script>, xml's old nemesis. You strike again.

This is why javascript in XHTML needs to be wrapped in <![CDATA[ to be valid. (Which was a stupid awful pattern, imo.)

Yeah, probably <style> should behave the same way.

from sax-js.

pull request including a test, added

from sax-js.

The tricky thing about this is something like:

<div>
<script>alert("</script>")</script>

I'm certainly not interested in implementing a full JavaScript syntax parser.

Would it be an acceptable constraint to say that </script> in a string will cause it to end the script block? After all, early browser engines worked this way, right?

from sax-js.

Actually, it seems like any </ is not really allowed by the html spec, so let's start with that.

from sax-js.

A lot of websites are doing this:

<script>$('body').html('<div>hello</div>')</script>

And sax-js fails on this.

You give ..

<div>
<script>alert("</script>")</script>

.. as an example for not directly search for </script> to close a <script>.

But this example already fails on browsers which can't interpret it.
This is why most <script> inside <script> are splitted ('<scr'+'ipt').

We are planning on directly search for </script> and be able to handle cases like </div>, what do you think.

from sax-js.

@vvo sure, patch welcome.

from sax-js.

@isaacs, @vvo, the pull request fixing the </script> detection is attached to the issue #80.

from sax-js.