26652 - www.flipcode.com displays JavaScript code on the page

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Neil Marshall]

Here is the code (Captured by nav4.7... mozilla displays less code than this for
some reason).  Anyways, in the Netscape part I can't see any messups.  Mozilla
returns the appname of "Netscape" so its not going into the ie code.

I've gone over it a few times now.  Other than the little extra characters on
the end of the lines I can't seem to find anything wrong with it.



--------------

<SCRIPT language=JavaScript>

<!--
if(navigator.appName=="Netscape") { //detects whether they're using netscape or not
        isNav=true;
        } else {
        isNav=false;
        }

//-->

</SCRIPT>

<SCRIPT language=JavaScript>

<!--
function makeAd(extras)
{
 var now = new Date();
 var magic = now.getTime();

if(isNav==true) {
 document.write("<DIV SRC='http://as0.cybereps.com:8880/hserver");
 document.write(extras);
 document.write("?Page=");
 document.write(magic);
 document.write("' NORESIZE SCROLLING=NO HSPACE=0 VSPACE=0 FRAMEBORDER=0
MARGINHEIGHT=0 MARGINWIDTH=0 WIDTH=468 HEIGHT=60>");
 document.write("<SCRIPT SRC='http://as0.cybereps.com:8880/jserver");
 document.write(extras);
 document.write("?Page=");
 document.write(magic);
 document.write("'>");
 document.write("</XMP><PRE><B>&lt;<FONT SIZE=+0
COLOR="#551A8B">/SCRIPT</FONT>&gt;</B>");
 document.write("<B>&lt;<FONT SIZE=+0 COLOR="#551A8B">/DIV</FONT>&gt;</B>");
        }else{
 document.write("<B>&lt;<FONT SIZE=+0 COLOR="#551A8B">IFRAME</FONT>
SRC=</B><FONT SIZE=+0
COLOR="003E98">'http://as0.cybereps.com:8880/hserver"</FONT><B> + extras +
"?Page=</B><FONT SIZE=+0 COLOR="003E98">" + magic + "</FONT><B>' NORESIZE
SCROLLING=</B><FONT SIZE=+0 COLOR="003E98">NO</FONT><B> HSPACE=</B><FONT SIZE=+0
COLOR="003E98">0</FONT><B> VSPACE=</B><FONT SIZE=+0 COLOR="003E98">0</FONT><B>
FRAMEBORDER=</B><FONT SIZE=+0 COLOR="003E98">0</FONT><B> MARGINHEIGHT=</B><FONT
SIZE=+0 COLOR="003E98">0</FONT><B> MARGINWIDTH=</B><FONT SIZE=+0
COLOR="003E98">0</FONT><B> WIDTH=</B><FONT SIZE=+0 COLOR="003E98">468</FONT><B>
HEIGHT=</B><FONT SIZE=+0 COLOR="003E98">60</FONT><B>&gt;</B>");
 document.write("<B>&lt;<FONT SIZE=+0 COLOR="#551A8B">SCRIPT</FONT>
SRC=</B><FONT SIZE=+0
COLOR="003E98">'http://as0.cybereps.com:8880/jserver"</FONT><B> + extras +
"?Page=</B><FONT SIZE=+0 COLOR="003E98">" + magic +
"</FONT><B>'&gt;</B></PRE><XMP></XMP><PRE><B>&lt;<FONT SIZE=+0
COLOR="#551A8B">/SCRIPT</FONT>&gt;</B>");
 document.write("<B>&lt;<FONT SIZE=+0 COLOR="#551A8B">/IFRAME</FONT>&gt;</B>");
 document.write("<B>&lt;<FONT SIZE=+0 COLOR="#551A8B">br</FONT>&gt;</B>");
        }
}
//-->

Comment 1

[Mike McCabe]

If you're also seeing script code in 4.7, then this doesn't seem like a
mozilla-specific bug.  Maybe it's something with your page?

I'm wondering if the \<SCRIPT in the text below -

document.write("<SCRIPT SRC='http://as0.cybereps.com:8880/jserver");

is confusing the script tag somehow; have you considered adding \ escapes to
this and similar text sequences in your code?

Mike

Comment 2

[Neil Marshall]

I'm not seeing this in v4.7 and its not my site.  Its a popular programming 
site.

I could see that </script> confusing the browser, but it shouldn't.  The 
really wierd thing is, when you actually save the code to your HD using v4.7, 
those > and <'s are not there.

If I try to save it via Mozilla I just get an "Unknown Error" - guess save as is 
not working yet.

Comment 3

[Mike McCabe]

I've reproduced this, and it seems to be a problem.  Adding www.flipcode.com in
the URL field.

Marshall:  Something that would greatly help us fix this bug is if you could
boil this problem down to the *simplest possible testcase* that still
demonstrates the problem.  Maybe a single .html file with 10 lines and a script
tag.  It's always much easier to identify and fix the problem if there's nothing
going on in the problem page.  We get lots of bug reports, and it's a big help
if we can identify the exact problem quickly

This looks like a problem in parsing .html to find the beginnings and ends of
SCRIPT tags.  I think nisheeth handles html parsing; reassigning to him.

Mike

Comment 4

[Nisheeth Ranjan]

Passing this on to Harish based on Mike's comments.  Mike, Harish is the owner 
of the html parser.

Comment 5

[Sean Chitwood]

Attachment: Minimal test case

Comment 6

[Sean Chitwood]

This does appear to be a problem with a </SCRIPT> tag in a JS text string ending 
the <SCRIPT> BLock....

THere seems to be another issue as well, code that should be in a HTML comment 
is being parsed and displayed. Particularly the code that is appearing on the 
screen.

Comment 7

[harishd]

Attachment: Saving the problem page.

Comment 8

[Johnny Stenback (:jst)]

*** Bug 33352 has been marked as a duplicate of this bug. ***

Comment 9

[harishd]

Added code, for compatibility, to handle </SCRIPT> in document.write.

Note: This fix is for quirks mode only.

Comment 10

[Keyser Sose]

Works for Me
Platform: PC
OS: Windows 98
Mozilla Version: 2000100508

Marking as Verified

Comment 11

[Brendan Eich [:brendan]]

Not sure this was fixed the right way, as it led to bug 219504.

/be