RFE: More nuanced validation of <script> with data blocks
Leif H Silli <[email protected]> Sat, 10 Jun 2023 03:01:28 +0200
| Newsgroups | gmane.editors.xxe.general |
|---|---|
| Organization | Lenk.no/Silli |
| Message-ID | <[email protected]> |
Proposal: In case of <script type="none-JavaScript-MIME-type-goes-here" >, or put differently: When <script> is used for data blocks, the XXE validation tool should not stamp child elements of <script> as illegal. (At least not when the data block, per the particular script element’s type attribute is a XML-based markup language.) Alternatively, XXE should allow to specify in the preferences that, for specific MIME types, then <script type="none-JavaScript-MIME-type-goes-here" > should be ignored by the validation tool. (I prefer the first variation, so as to not have to fiddle with preferences.) Description: HTML5 defines 3 variants of HTML: DOM, XML and (text/)HTML, and points out that what is possible or impossible in one of them, might be possible or impossible in another. And the <script> element is one of the elements whichs behaves quite differently in XML compared to text/HTML. Basically, in text/HTML, the <script> cannot contain any child elements (the parser simply views any code as pure text). Whereas in XML it can. Per HTML5, the default state of the <script> element (that is: the omission of the type attribute) means that the content is supposed to be a “classic script”. [1] And so, this is not a “classic script”: <script><style>/*CSS*/</style></script> XXE’s Validator stamps the above code as invalid - and this is correct, if we look at the content. (However, by contrast - and strikingly, if you check the above code in an HTML5 text/HTML validation tool, the above is actually considered valid, because all the content it sees is just text, e.g. try https://validator.nu ) (By the way, I am not certain what happens, if the JavaScript engine detects e.g. a <style> element inside the <script> element. But I guess it could stop the script from running.) HTML5 goes on to define certain keywords, such as "module" – <script type="module"> , and promise that extensions to how <script> behaves, will be made via such keywords. However, the above code example would be invalid for all the current keywords (and thus also are invalid also per XXE's validator). However, HTML5 says that <script> can also be used to contain “data blocks": [2] «Setting the attribute to any other value means that the script is a data block, which is not processed. None of the script attributes (except type itself) have any effect on data blocks. Authors must use a valid MIME type string that is not a JavaScript MIME type essence match to denote data blocks.» And so we could have the following: <script type="application/xhtml+xml"><style>/*CSS*/</style></script> Currently, XXE Validation tool stamps that as well as invalid. However, it seems to me that it is **not** invalid. A more precise feedback, if feedback is necessary, would be to inform that the above content is treated differently when parsed as XML compared to when parsed as text/HTML. (In fact, in an XML parser, the style rules found inside the child element '<style>', would in fact be applied, whereas in a text/HTML parser, it would not be applied.) Finally, I want to be so honest as to confess that the issue discussed in this email, for me has several layers and motifs: (1) I happen to think that <style> should be permitted the same places that the <script> element is permitted, and not only in the <head> element. Such a permission should probably be on the condition of certain authoring requirements. (The condition could be that every style rule only targets the current element and/or its children.) And I guess I should file a bug report against the HTML5 specifcation to make this happen. But until that becomes a feature of HTML5, the above for me is a way to circumvent the validation error message in XXE - because those messages are annoying (if not so much for myself, then at least for other XXE users). (2) XXE already allows us to author HTML documents that does not meet the (text/)HTML conditions for a HTML document. For instance, it can be used to author documents that consists of only an <article> element (and no <html>, <head> or <body> element). Such a document is already “invalid”. But XXE’s validator does fortunately not bother to tell me about it! Which is great, because I like to use XXE to author HTML fragments that can be included or pasted in to ordinary web pages. Regardless, XXE ought to treat data blocks different from other script content. https://html.spec.whatwg.org/multipage/scripting.html#data-block [1] https://html.spec.whatwg.org/multipage/scripting.html#attr-script-type [2] https://html.spec.whatwg.org/multipage/scripting.html#data-block Leif Halvard Silli -- XMLmind XML Editor Support List [email protected] http://www.xmlmind.com/mailman/listinfo/xmleditor-support