- From: Ian Hickson <ian@hixie.ch>
- Date: Tue, 14 Mar 2006 07:15:41 +0000 (UTC)
On Mon, 13 Mar 2006, L. David Baron wrote:
>
> STYLE and SCRIPT elements have similar parsing rules in tag-soup HTML,
> where everything is treated as text until </style> or </script>. This
> is why you see an alert with stuff that looks like tags in:
>
> data:text/html,<style><b><i></style><script>alert(document.getElementsByTagName('style')[0].firstChild.data)</script>
>
> or that script like:
>
> <script>
> document.write("<b>foo</b>");
> </script>
>
> actually works.
Yes, I am aware of this. :-)
> SGML says something slightly different (IIRC, that the element ends at
> the first "</", and if the thing that follows isn't the tag name then
> the document is wrong), but it is based on an underlying SGML concept (a
> content model of "CDATA" in the HTML4 DTD for both elements (different
> as an element content model than as an attribute value type), rather
> than "#PCDATA").
Indeed.
> If the spec is already clear on this, then perhaps nothing needs
> changing; I was just responding to the quoted text.
I believe the spec is unambiguous about this, yes.
--
Ian Hickson U+1047E )\._.,--....,'``. fL
http://ln.hixie.ch/ U+263A /, _.. \ _\ ;`._ ,.
Things that are impossible just take longer. `._.-(,_..'--(,_..'`-.;.'
Received on Monday, 13 March 2006 23:15:41 UTC