Html::escapeCdataElement() not adding CDATA correctly

Created on 19 January 2022, over 2 years ago
Updated 16 May 2023, about 1 year ago

Problem/Motivation

When adding a <script> or <style> elements to a filtered text field Html::escapeCdataElement() gets called by a number of filters via Html::normalize() or Html::serialize() which encloses the contents of the elements in a CDATA, but this is causing some issues.

Basically I have found 3 issues.

1. The opening and closing comments are being wrapped in a HTML comment which is not applicable to a script or a style element. See #3162421: Upgrade HTML::escapeCdataElement to correctly comment CDATA β†’ for a fix.
2. Since Html::escapeCdataElement() is called from multiple filters, (i.e. the HTML corrector and the Alignment filters) the CDATA's are not being nested correctly. Infact http://wikipedia.org/wiki/CDATA#Nesting and when it is being called 7 times you get a real mess.

<style type="text/css">
/*<![CDATA[*/

/*<![CDATA[*/

/*<![CDATA[*/

/*<![CDATA[*/

/*<![CDATA[*/

/*<![CDATA[*/

/*<![CDATA[*/
.content { max-width: 100%; }
/*<!]]]]]]]]]]]]]]><![CDATA[><![CDATA[><![CDATA[><![CDATA[><![CDATA[><![CDATA[>*/

/*<!]]]]]]]]]]]]><![CDATA[><![CDATA[><![CDATA[><![CDATA[><![CDATA[>*/

/*<!]]]]]]]]]]><![CDATA[><![CDATA[><![CDATA[><![CDATA[>*/

/*<!]]]]]]]]><![CDATA[><![CDATA[><![CDATA[>*/

/*<!]]]]]]><![CDATA[><![CDATA[>*/

/*<!]]]]><![CDATA[>*/

/*<!]]>*/
</style>

3. Lastly I do not think that we should be nesting CDATA. It is not needed,

Steps to reproduce

In a text filtered field add the following

<style>.content { max-width: 100%; }</style>

If you are using a text format which uses multiple filters like HTML filter, HTML Corrector filter, Align filter, it will result in the multiple nesting.

Proposed resolution

Add a check in the escapeCdataElement() if data contains CDATA and wrap that way.

Previous proposal
I am not sure we need the nesting behaviour, But how we check for it I am not 100% sure. I.e. Should be just search for CDATA or search for "\n{$comment_start}

Html::escapeCdataElement() is only called from Html::serialize() (In core) for script and style elements so really the nesting functionality could be removed.

API changes

If we correct the nesting behaviour to produce correct nesting we may want to add a flag to turn on and off the nesting just in case someone is relying on this feature.

πŸ› Bug report
Status

Fixed

Version

10.1 ✨

Component
FilterΒ  β†’

Last updated 2 days ago

No maintainer
Created by

πŸ‡¦πŸ‡ΊAustralia gordon Melbourne

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024