[patch] HTML parser bugfix
123 <[email protected]>
| Newsgroups | gmane.comp.web.dillo.devel |
|---|---|
| Message-ID | <[email protected]> |
The following HTML fragment is shown as BUG<">abc by Dillo. It is valid (checked with validator.w3.org) HTML. In Firefox it is shown as abc with '>BUG<' tooltip. <div title=">BUG<">abc</div> What happens is that Dillo see < character inside quotes, shows bug "attribute lacks closing quote" and breaks out of tag parsing loop. In fact it is not possible to say if there is a bug in HTML at that point. In WWW you can see this bug on http://reddit.com. Each entry on this page contains votehash', null, event)" > and bug meter shows bugs for them. Attached patch removes logic that tries to detect unterminated quoted attributes and fixes this bug. _______________________________________________ Dillo-dev mailing list [email protected] http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev
html.diff
(text/plain, 1.7 KB)
diff -r 64be2bc62b71 src/html.cc
--- a/src/html.cc Sun Jun 03 14:27:40 2012 +0400
+++ b/src/html.cc Sun Jun 03 22:00:08 2012 +0400
@@ -3828,28 +3828,15 @@
while ( buf_index < bufsize ) {
buf_index++;
buf_index += strcspn(buf + buf_index, ">\"'<");
- if ((ch = buf[buf_index]) == '>') {
+ ch = buf[buf_index];
+ if (ch == '>') {
break;
} else if (ch == '"' || ch == '\'') {
/* Skip over quoted string */
buf_index++;
- buf_index += strcspn(buf + buf_index,
- (ch == '"') ? "\">" : "'>");
- if (buf[buf_index] == '>') {
- /* Unterminated string value? Let's look ahead and test:
- * (<: unterminated, closing-quote: terminated) */
- int offset = buf_index + 1;
- offset += strcspn(buf + offset,
- (ch == '"') ? "\"<" : "'<");
- if (buf[offset] == ch || !buf[offset]) {
- buf_index = offset;
- } else {
- BUG_MSG("attribute lacks closing quote\n");
- break;
- }
- }
+ buf_index += strcspn(buf + buf_index, ch == '"' ? "\"" : "'");
} else if (ch == '<') {
- /* unterminated tag detected */
+ /* Unterminated tag detected */
p = dStrndup(buf+token_start+1,
strcspn(buf+token_start+1, " <"));
BUG_MSG("<%s> element lacks its closing '>'\n", p);