Skip to content

RewritingStream incorrectly escaping contents of <script> tags via emitText() #339

@nfriedly

Description

@nfriedly

This is related to but distinct from #333

The RewritingStream.emitText() method always calls escapeString on the text:

emitText({ text }) {
this.push(escapeString(text, false));
}

This causes it to break JavaScript. For example:

<script type="text/javascript">
(function() {
  if ('PerformanceObserver' in window && 'PerformancePaintTiming' in window) {
    // ...

ends up as

<script type="text/javascript">
(function() {
  if ('PerformanceObserver' in window &amp;&amp; 'PerformancePaintTiming' in window) {
    // ...

and then the browser's JS parser chokes with a syntax error when it hits the &amp;&amp;.

It should probably do something similar to what _serializeTextNode does:

if (
parentTn === $.STYLE ||
parentTn === $.SCRIPT ||
parentTn === $.XMP ||
parentTn === $.IFRAME ||
parentTn === $.NOEMBED ||
parentTn === $.NOFRAMES ||
parentTn === $.PLAINTEXT ||
parentTn === $.NOSCRIPT
) {
this.html += content;
} else {
this.html += Serializer.escapeString(content, false);
}

(Or, whatever it ends up doing after the resolution of #333)

For a short-term workaround, I'm going to just call stream.push() stream.emitRaw() when inside of a <script> tag.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions