Skip to content

Latte: Incorrect context-aware escaping for <script> #705

@Majkl578

Description

@Majkl578

If someone wants to use <script> for non-javascript things, its content will be escaped incorrectly. Consider an example, where script content is used as a template for latter javascript processing (e.g. replacing some placeholders and then inserting into DOM):

<script id="foo" type="text/x-something">
    {$foo}
</script>

$foo will now be incorrectly escaped as a Javascript code (output will be quoted and escaped), not as a regular HTML code.

I suggest fixing this behavior by treating <script> tag's contents as a Javascript code only if the type parameter is either text/javascript or nothing.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions