1540675 - Handle line breaks correctly in comment end bang state

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, enhancement, P2)

Description

[Frederik Braun [:freddy] (OOO until August 18th)]

Example:

<!-- --!

><img src=1 onerror=alert(1)> -->

Should the <img> tag work if the closing comment is interrupted by newlines?

Note that interrupting the closing comment after the exclamation mark with a whitespaces (e.g., space 0x20 or tab 0x09) does not work.

Comment 1

[Henri Sivonen (:hsivonen)]

Looks like a bug!

Comment 2

[Henri Sivonen (:hsivonen)]

Attachment: Bug 1540675 - Handle line breaks correctly in comment end bang state.

Comment 3

[Henri Sivonen (:hsivonen)]

Upstream tests: https://github.com/html5lib/html5lib-tests/pull/121

Comment 4

[Henri Sivonen (:hsivonen)]

Attachment: Java patch

Comment 5

[Henri Sivonen (:hsivonen)]

Using ni for r? on the Java patch, since actual r? is blocked. Note that the patch has test harness changes that aren't reflected in C++.

Comment 6

[Henri Sivonen (:hsivonen)]

Intentionally leaving error reporting changes to bug 1541853.

Comment 7

[Henri Sivonen (:hsivonen)]

(In reply to Henri Sivonen (:hsivonen) from comment #3)

Upstream tests: https://github.com/html5lib/html5lib-tests/pull/121

The CR and CRLF cases are tested on Java side only, because we can't run tokenizer tests in the Gecko context, and putting CR or CRLF in tree builder tests would get broken by the next person's text editor.

Try run:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=01c8f6f5e8669b635cda9c26e51550684b76a49d

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4aeaae90b1a1
Handle line breaks correctly in comment end bang state. r=alchen.

Comment 9

[Henri Sivonen (:hsivonen)]

https://hg.mozilla.org/projects/htmlparser/rev/414909492b9d

Comment 10

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/4aeaae90b1a1