Bug #74858 [Opn->Nab]: DOMDocument loadHTML parses html tags inside cdata
Edit report at https://bugs.php.net/bug.php?id=74858&edit=1
ID: 74858
Updated by: requinix@php.net
Reported by: qdinar at gmail dot com
Summary: DOMDocument loadHTML parses html tags inside cdata
-Status: Open
+Status: Not a bug
Type: Bug
-Package: *General Issues
+Package: DOM XML related
Operating System: windows 10
PHP Version: 5.6.30
Block user comment: N
Private report: N
New Comment:
CDATA sections are not interpreted in HTML (only in XML and XHTML) and HTML parsers are not aware of
the Javascript language, so that </script> in the string will be treated as the end tag for
the earlier <script>.
If you want a literal "</script>" then escape the slash like
b='<\/script>';
This breaks apart the </ sequence and prevents the rest from being parsed as an end tag.
The other bug report may look similar but it is a different issue.
Previous Comments:
------------------------------------------------------------------------
[2017-07-05 06:45:24] qdinar at gmail dot com
Description:
------------
cdata which was used to escape html tags inside strings inside script tags failed to perform that
task while it was feed to PHP's DOMDocument's loadHTML , which is made with libxml.
you can see in the example that "c='456'; //]]> " - content of script element
is going to be outputted to user.
i reported this for libxml to https://bugzilla.gnome.org/show_bug.cgi?id=784517
but it was suggested to report to php.
i have found similar bug https://bugs.php.net/bug.php?id=71452 here but it
is for case without "cdata", so i report another bug.
Test script:
---------------
$test_content='
<script>
//<![CDATA[
a=\'123\';
b=\'</script>\';
c=\'456\';
//]]>
</script>
';
$d=new DOMDocument();
$d->loadHTML($test_content);
echo $d->saveHTML();
Expected result:
----------------
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html><head>
<script>
//<![CDATA[
a='123';
b='</script>';
c='456';
//]]>
</script>
</head>
<body></body>
</html>
Actual result:
--------------
PHP Warning: DOMDocument::loadHTML(): Unexpected end tag : script in Entity, line: 8 in
C:\xampp\htdocs\test\dom_cdata.php on line 13
Warning: DOMDocument::loadHTML(): Unexpected end tag : script in Entity, line: 8 in
C:\xampp\htdocs\test\dom_cdata.php on line 13
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html><head><script>
//<![CDATA[
a='123';
b='</script></head><body><p>';
c='456';
//]]>
</p></body></html>
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=74858&edit=1
Thread (5 messages)