-
Notifications
You must be signed in to change notification settings - Fork 2.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Rephrase misleading recommendation to escape "<script" as "<\script" in literals #7179
Comments
Perhaps a different letter from |
I think this is also undesirable since that is disallowed in regular expressions with the |
Escaping |
See whatwg/html#7179 Bug: none Change-Id: Ida622dfa42b319a27a399d780b0639503e7653a9 Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/3231277 Reviewed-by: Mathias Bynens <mathias@chromium.org> Commit-Queue: Johan Bay <jobay@chromium.org>
https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
It’s misleading to state that this is the way to do it in all literals including regular expression literals, since
\s
(in<\script
) has a different meaning in regular expression literals (it matches whitespace instead of the characters
). We could either suggest a different way of escaping this (e.g."<script"
as"\x3Cscript"
) or clarify that for regular expression literals specifically a different approach should be used.The text was updated successfully, but these errors were encountered: