php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #80095 dom document parsing inline javascript errors
Submitted: 2020-09-12 11:06 UTC Modified: 2020-09-12 20:38 UTC
From: shariefjamiel at gmail dot com Assigned:
Status: Not a bug Package: DOM XML related
PHP Version: 7.4Git-2020-09-12 (Git) OS: ubuntu 20.04
Private report: No CVE-ID: None
 [2020-09-12 11:06 UTC] shariefjamiel at gmail dot com
Description:
------------
When loading HTML in the DOMDocument with an inline script within a DIV and there is javascript with DIV html, the ending script tag gets put in the wrong place.

Notice the closing script tag, its been put in the wrong place

.append("<div class=\"d-flex\"><div class=\"column\">" + item.value + "</script></div>

In this case removing the outer div, fixes the problem or escaping the html within the javascript append method.

Test script:
---------------
<?php

$html = <<< EOT
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
</head>
<body>
<div class="if-you-remove-me-everything-is-fine">
    <script>
        function initialize() {
            $('#search').autocomplete({
                source: '/api/search',
                minLength: 2,
                autoFocus: true,
            }).autocomplete("instance")._renderItem = function(ul, item) {
                return $("<li>")
                    .append("<div class=\"d-flex\"><div class=\"column\">" + item.value + "</div> <div class=\"flex-grow-1\">" + item.label + "</div> <div class=\"column text-right\">" + item.exchange + "</div> </div>")
                    .appendTo(ul);
            };
        }
    </script>  
</div>
</body>
</html>

EOT;
/**
 * Two ways to solve problem
 *
 * 1. remove outer div
 * 2. escape the html contents in javascript
 */

$doc = new DOMDocument();
$doc->loadHTML($html, LIBXML_HTML_NODEFDTD);
echo $doc->saveHTML();


Expected result:
----------------
Expect the ending script tag to be put where it was

Actual result:
--------------
The script tag was placed inside the inline javascript code

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-09-12 20:38 UTC] requinix@php.net
-Status: Open +Status: Not a bug
 [2020-09-12 20:38 UTC] requinix@php.net
libxml uses HTML 4 rules which say that </ is an ending tag. Even if the tag doesn't match the last opening tag.
To avoid this problem, write the ending tags in your script as "<\/".
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Apr 24 23:01:34 2024 UTC