Bug #73767 [NEW]: script in document.write (string) in <script> in html get corrupted

From: justin dot maxwell at tibit dot com Operating system: Mint 18 PHP version: 7.0.14 Package: DOM XML related Bug Type: Bug Bug description:script in document.write (string) in <script> in html get corrupted Description: ------------ --- From manual page: http://www.php.net/book.libxml --- PHP 7.0.8-0ubuntu0.16.04.3 I have no control of the site with this erm, <expletive> oldskool hacky code in it, but I need to parse it. See the HTML snippet in the test script for details, but after loadHTML, saveHTML, the string parameter to document.write is missing a piece. On input, it is: '<scr'+'ipt src="http://example.com/some.js"></scr'+'ipt>' On output : '<scr'+'ipt src="http://example.com/some.js">'+'ipt>' Which of course wreaks havoc with the unclosed injected script tag. Incidentally, : '<scr'+'ipt src="http://example.com/some.js"><'+'/scr'+'ipt>' ... on first glance, seems to be parsed without corruption. Test script: --------------- Using HTML as beneath $doc= new DOMDocument(); $doc->loadHTMLFile('test-libxml.html'); $doc->saveHTML(); <!DOCTYPE html> <html> <head> <title>Test libxml</title> </head> <body> <script type="text/javascript"> document.write('<scr'+'ipt src="http://example.com/some.js"></scr'+'ipt>'); </script> </body> </html> Expected result: ---------------- <!DOCTYPE html> <html> <head> <title>Test libxml</title> </head> <body> <script type="text/javascript"> document.write('<scr'+'ipt src="http://example.com/some.js">'+'ipt>'); </script> </body> </html> Actual result: -------------- <!DOCTYPE html> <html> <head> <title>Test libxml</title> </head> <body> <script type="text/javascript"> document.write('<scr'+'ipt src="http://example.com/some.js"></scr'+'ipt>'); </script> </body> </html> -- Edit bug report at https://bugs.php.net/bug.php?id=73767&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73767&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73767&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73767&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73767&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73767&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73767&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73767&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73767&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73767&r=support Expected behavior: https://bugs.php.net/fix.php?id=73767&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73767&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73767&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73767&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73767&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73767&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73767&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73767&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73767&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73767&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73767&r=mysqlcfg