-
-
Notifications
You must be signed in to change notification settings - Fork 230
Closed
Description
If someone wants to use <script> for non-javascript things, its content will be escaped incorrectly. Consider an example, where script content is used as a template for latter javascript processing (e.g. replacing some placeholders and then inserting into DOM):
<script id="foo" type="text/x-something">
{$foo}
</script>
$foo will now be incorrectly escaped as a Javascript code (output will be quoted and escaped), not as a regular HTML code.
I suggest fixing this behavior by treating <script> tag's contents as a Javascript code only if the type parameter is either text/javascript or nothing.