[patch] HTML parser bugfix

123 <[email protected]>
Newsgroups gmane.comp.web.dillo.devel
Message-ID <[email protected]>
The following HTML fragment is shown as
   BUG<">abc
by Dillo. It is valid (checked with validator.w3.org) HTML. In Firefox
it is shown as
   abc
with '>BUG<' tooltip.

<div title=">BUG<">abc</div>

What happens is that Dillo see < character inside quotes, shows bug
"attribute lacks closing quote" and breaks out of tag parsing loop. In
fact it is not possible to say if there is a bug in HTML at that
point.

In WWW you can see this bug on http://reddit.com. Each entry on this
page contains
   votehash', null, event)" >
and bug meter shows bugs for them.

Attached patch removes logic that tries to detect unterminated quoted
attributes and fixes this bug.

_______________________________________________
Dillo-dev mailing list
[email protected]
http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev
html.diff (text/plain, 1.7 KB)
diff -r 64be2bc62b71 src/html.cc
--- a/src/html.cc	Sun Jun 03 14:27:40 2012 +0400
+++ b/src/html.cc	Sun Jun 03 22:00:08 2012 +0400
@@ -3828,28 +3828,15 @@
             while ( buf_index < bufsize ) {
                buf_index++;
                buf_index += strcspn(buf + buf_index, ">\"'<");
-               if ((ch = buf[buf_index]) == '>') {
+               ch = buf[buf_index];
+               if (ch == '>') {
                   break;
                } else if (ch == '"' || ch == '\'') {
                   /* Skip over quoted string */
                   buf_index++;
-                  buf_index += strcspn(buf + buf_index,
-                                       (ch == '"') ? "\">" : "'>");
-                  if (buf[buf_index] == '>') {
-                     /* Unterminated string value? Let's look ahead and test:
-                      * (<: unterminated, closing-quote: terminated) */
-                     int offset = buf_index + 1;
-                     offset += strcspn(buf + offset,
-                                       (ch == '"') ? "\"<" : "'<");
-                     if (buf[offset] == ch || !buf[offset]) {
-                        buf_index = offset;
-                     } else {
-                        BUG_MSG("attribute lacks closing quote\n");
-                        break;
-                     }
-                  }
+                  buf_index += strcspn(buf + buf_index, ch == '"' ? "\"" : "'");
                } else if (ch == '<') {
-                  /* unterminated tag detected */
+                  /* Unterminated tag detected */
                   p = dStrndup(buf+token_start+1,
                                strcspn(buf+token_start+1, " <"));
                   BUG_MSG("<%s> element lacks its closing '>'\n", p);
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.