Description
Preconditions and environment
System:
Magento Version: 2.4.6-p9
PHP Version: 8.1
Modules:
magento/page-builder: 1.7.3-p9
Steps to reproduce
- Create a Content Page in CMS
- Open the Content Tab
- Open the Page builder
- Add some Lorem Ipsum content (any tags/images flow content)
- Add a HTML Block
- Create an opening
div
tag (with/without id, class etc.) - Create an opening
script
tag, (with/without source, id, error etc.) - Save the page builder html block
- Save the page
- Visit the page (see that the script tag is not automatically closed, hopefully, but the div tag is).
Expected result
Example Expected Results (with correctly closed current behavior for div tag):
When adding a <script>
to the HTML Block, it will either self close: <script/>
or add a closing tag <script>...</script>
.
Actual result
Adding a non-closed / unmatched script tag to a HTML Block will absorb all page content until the next closing script tag, causing unpredictable and broken page behavior, changing page flow and causing other scripts on the page to potentially break.
Please see in the second Actual result screenshot that the script tag matched up until the text/x-magento-init
's closing script tag.
Additional information
This caused several issues by absorbing the rest of the page until the next closing script tag and caused unpredictable behavior across different browsers and how they parsed it.
We understand that the comment underneath the HTML Block asks for valid HTML and Script tags only, but have made this report to add resilience for clients using it and risking breaking important/critical functionality, we ask that a check can be put in place to handle non-closed/unmatched script tags, much like how content HTML tags are handled (see expected results div
example).
We think an S4 priority is apt for this issue due to the workaround being to properly implement this in the first place.
Thank you.
Release note
Script Tags in Page Builder Html Blocks now automatically get closed if not manually closed inside the html block to prevent the absorbing of html content and other scripts in the html page flow.
Triage and priority
- Severity: S0 - Affects critical data or functionality and leaves users without workaround.
- Severity: S1 - Affects critical data or functionality and forces users to employ a workaround.
- Severity: S2 - Affects non-critical data or functionality and forces users to employ a workaround.
- Severity: S3 - Affects non-critical data or functionality and does not force users to employ a workaround.
- Severity: S4 - Affects aesthetics, professional look and feel, “quality” or “usability”.