Bug 32962

Summary: HTML tags are wrongfully parsed when setting innerHTML of a SCRIPT element
Product: WebKit Reporter: jenseki.netro
Component: DOMAssignee: Alexey Proskuryakov <ap>
Status: RESOLVED FIXED    
Severity: Major CC: ap, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
URL: http://netro.fileave.com/webkitbug1.html
Attachments:
Description Flags
test case
none
proposed fix mitz: review+

jenseki.netro
Reported 2009-12-27 06:57:25 PST
Not working with Chrome 4 (dev channel) and Safari 3.2.2 Working with Firefox 3.5 Go to the URL. Check the DOM. Compare it with http://netro.fileave.com/webkitbug2.html. The bug is caused by the "<" character in webkitbug1.html's string variable temp. When the created script element is appended, its innerHTML treats /<.*>/ as HTML tags. And this causes the error.
Attachments
test case (220 bytes, text/html)
2009-12-27 18:04 PST, Alexey Proskuryakov 		no flags
Details
proposed fix (6.50 KB, patch)
2010-01-07 17:22 PST, Alexey Proskuryakov 		mitz: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2009-12-27 18:03:37 PST
An obvious workaround is to use textContent instead of innerHTML (innerText also works, but it's not supported by Firefox).
Alexey Proskuryakov
Comment 2 2009-12-27 18:04:13 PST
Created attachment 45539 [details] test case
Alexey Proskuryakov
Comment 3 2010-01-07 17:22:21 PST
Created attachment 46100 [details] proposed fix This fixes the problem for SCRIPT and STLYE elements (actually, we didn't support setting innerHTML for style at all before). I'm not sure if any other elements need this treatment - Firefox behavior seems somewhat confused, as it applies it to NOSCRIPT for whatever reason.
WebKit Review Bot
Comment 4 2010-01-07 17:25:39 PST
style-queue ran check-webkit-style on attachment 46100 [details] without any errors.
Alexey Proskuryakov
Comment 5 2010-01-08 16:30:35 PST
Committed <http://trac.webkit.org/changeset/53023>.
Note You need to log in before you can comment on or make changes to this bug.