Closed Bug 1540675 Opened 6 months ago Closed 5 months ago

Handle line breaks correctly in comment end bang state

Categories

(Core :: HTML: Parser, enhancement, P2)

enhancement

Tracking

()

RESOLVED FIXED
mozilla68
Tracking Status
firefox68 --- fixed

People

(Reporter: freddyb, Assigned: hsivonen)

References

Details

Attachments

(2 files)

Example:

<!-- --!

><img src=1 onerror=alert(1)> -->

Should the <img> tag work if the closing comment is interrupted by newlines?

Note that interrupting the closing comment after the exclamation mark with a whitespaces (e.g., space 0x20 or tab 0x09) does not work.

Looks like a bug!

Assignee: nobody → hsivonen
Status: NEW → ASSIGNED
Attached patch Java patchSplinter Review

Using ni for r? on the Java patch, since actual r? is blocked. Note that the patch has test harness changes that aren't reflected in C++.

Flags: needinfo?(alchen)

Intentionally leaving error reporting changes to bug 1541853.

Summary: Should HTML parser allow newlines within closing HTML comment? → Handle line breaks correctly in comment end bang state

(In reply to Henri Sivonen (:hsivonen) from comment #3)

Upstream tests: https://github.com/html5lib/html5lib-tests/pull/121

The CR and CRLF cases are tested on Java side only, because we can't run tokenizer tests in the Gecko context, and putting CR or CRLF in tree builder tests would get broken by the next person's text editor.

Try run:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=01c8f6f5e8669b635cda9c26e51550684b76a49d

Attachment #9055810 - Flags: review+
Flags: needinfo?(alchen)
Priority: -- → P2
Pushed by hsivonen@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4aeaae90b1a1
Handle line breaks correctly in comment end bang state. r=alchen.
Status: ASSIGNED → RESOLVED
Closed: 5 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
You need to log in before you can comment on or make changes to this bug.