RFE: More nuanced validation of <script> with data blocks

Leif H Silli <[email protected]> Sat, 10 Jun 2023 03:01:28 +0200
Newsgroups gmane.editors.xxe.general
Organization Lenk.no/Silli
Message-ID <[email protected]>
Proposal:

In case of <script type="none-JavaScript-MIME-type-goes-here" >, or put 
differently: When <script> is used for data blocks, the XXE validation 
tool should not stamp child elements of <script> as illegal. (At least 
not when the data block, per the particular script element’s type 
attribute is a XML-based markup language.)

Alternatively, XXE should allow to specify in the preferences that, for 
specific MIME types, then <script 
type="none-JavaScript-MIME-type-goes-here" > should be ignored by the 
validation tool. (I prefer the first variation, so as to not have to 
fiddle with preferences.)

Description:

HTML5 defines 3 variants of HTML: DOM, XML and (text/)HTML, and points 
out that what is possible or impossible in one of them, might be 
possible or impossible in another. And the <script> element is one of 
the elements whichs behaves quite differently in XML compared to 
text/HTML. Basically, in text/HTML, the <script> cannot contain any 
child elements (the parser simply views any code as pure text). Whereas 
in XML it can.

Per HTML5, the default state of the <script> element (that is: the 
omission of the type attribute) means that the content is supposed to be 
a “classic script”. [1]  And so, this is not a “classic script”:

<script><style>/*CSS*/</style></script>

XXE’s Validator stamps the above code as invalid - and this is correct, 
if we look at the content. (However, by contrast - and strikingly, if 
you check the above code in an HTML5 text/HTML validation tool, the 
above is actually considered valid, because all the content it sees is 
just text, e.g. try https://validator.nu )

(By the way, I am not certain what happens, if the JavaScript engine 
detects e.g. a <style> element inside the <script> element. But I guess 
it could stop the script from running.)

HTML5 goes on to define certain keywords, such as "module" – <script 
type="module"> , and promise that extensions to how <script> behaves, 
will be made via such keywords.  However, the above code example would 
be invalid for all the current keywords (and thus also are invalid also 
per XXE's validator).

However, HTML5 says that <script> can also be used to contain “data 
blocks": [2]

«Setting the attribute to any other value means that the script is a 
data block, which is not processed. None of the script attributes 
(except type itself) have any effect on data blocks. Authors must use a 
valid MIME type string that is not a JavaScript MIME type essence match 
to denote data blocks.»

And so we could have the following:

<script type="application/xhtml+xml"><style>/*CSS*/</style></script>

Currently, XXE Validation tool stamps that as well as invalid. However, 
it seems to me that it is **not** invalid. A more precise feedback, if 
feedback is necessary, would be to inform that the above content is 
treated differently when parsed as XML compared to when parsed as 
text/HTML. (In fact, in an XML parser, the style rules found inside the 
child element '<style>', would in fact be applied, whereas in a 
text/HTML parser, it would not be applied.)

Finally, I want to be so honest as to confess that the issue discussed 
in this email, for me has several layers and motifs:

(1) I happen to think that <style> should be permitted the same places 
that the <script> element is permitted, and not only in the <head> 
element. Such a permission should probably be on the condition of 
certain authoring requirements. (The condition could be that every style 
rule only targets the current element and/or its children.) And I guess 
I should file a bug report against the HTML5 specifcation to make this 
happen. But until that becomes a feature of HTML5, the above for me is a 
way to circumvent the validation error message in XXE - because those 
messages are annoying (if not so much for myself, then at least for 
other XXE users).

(2) XXE already allows us to author HTML documents that does not meet 
the (text/)HTML conditions for a HTML document. For instance, it can be 
used to author documents that consists of only an <article> element (and 
no <html>, <head> or <body> element). Such a document is already 
“invalid”. But XXE’s validator does fortunately not bother to tell me 
about it! Which is great, because I like to use XXE to author HTML 
fragments that can be included or pasted in to ordinary web pages.

Regardless, XXE ought to treat data blocks different from other script 
content.

https://html.spec.whatwg.org/multipage/scripting.html#data-block

[1] 
https://html.spec.whatwg.org/multipage/scripting.html#attr-script-type
[2] https://html.spec.whatwg.org/multipage/scripting.html#data-block

Leif Halvard Silli

--
XMLmind XML Editor Support List
[email protected]
http://www.xmlmind.com/mailman/listinfo/xmleditor-support