Skip to content

Commit

Permalink
Clarify that developers also need to escape "<SCRiPT" etc.
Browse files Browse the repository at this point in the history
  • Loading branch information
ArgonAlex authored and domenic committed Dec 19, 2019
1 parent 9604516 commit 1beaf2d
Showing 1 changed file with 9 additions and 8 deletions.
17 changes: 9 additions & 8 deletions source
Expand Up @@ -59755,14 +59755,15 @@ o............A....e
<h5><dfn data-x="script content restrictions">Restrictions for contents of <code>script</code> elements</dfn></h5>

<p class="note">The easiest and safest way to avoid the rather strange restrictions described in
this section is to always escape "<code data-x="">&lt;!--</code>" as "<code
data-x="">&lt;\!--</code>", "<code data-x="">&lt;script</code>" as "<code
data-x="">&lt;\script</code>", and "<code data-x="">&lt;/script</code>" as "<code
data-x="">&lt;\/script</code>" when these sequences appear in literals in scripts (e.g. in
strings, regular expressions, or comments), and to avoid writing code that uses such constructs in
expressions. Doing so avoids the pitfalls that the restrictions in this section are prone to
triggering: namely, that, for historical reasons, parsing of <code>script</code> blocks in HTML is
a strange and exotic practice that acts unintuitively in the face of these sequences.</p>
this section is to always escape an ASCII case-insensitive match for "<code
data-x="">&lt;!--</code>" as "<code data-x="">&lt;\!--</code>", "<code
data-x="">&lt;script</code>" as "<code data-x="">&lt;\script</code>", and "<code
data-x="">&lt;/script</code>" as "<code data-x="">&lt;\/script</code>" when these sequences appear
in literals in scripts (e.g. in strings, regular expressions, or comments), and to avoid writing
code that uses such constructs in expressions. Doing so avoids the pitfalls that the restrictions
in this section are prone to triggering: namely, that, for historical reasons, parsing of
<code>script</code> blocks in HTML is a strange and exotic practice that acts unintuitively in the
face of these sequences.</p>

<p>The <code>script</code> element's <span>descendant text content</span> must match the <code
data-x="">script</code> production in the following ABNF, the character set for which is Unicode.
Expand Down

0 comments on commit 1beaf2d

Please sign in to comment.