Bug 32962 - HTML tags are wrongfully parsed when setting innerHTML of a SCRIPT element
Summary: HTML tags are wrongfully parsed when setting innerHTML of a SCRIPT element
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Major
Assignee: Alexey Proskuryakov
URL: http://netro.fileave.com/webkitbug1.html
Depends on:
Reported: 2009-12-27 06:57 PST by jenseki.netro
Modified: 2010-01-08 16:30 PST (History)
2 users (show)

See Also:

test case (220 bytes, text/html)
2009-12-27 18:04 PST, Alexey Proskuryakov
no flags Details
proposed fix (6.50 KB, patch)
2010-01-07 17:22 PST, Alexey Proskuryakov
mitz: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description jenseki.netro 2009-12-27 06:57:25 PST
Not working with Chrome 4 (dev channel) and Safari 3.2.2
Working with Firefox 3.5

Go to the URL. Check the DOM.
Compare it with http://netro.fileave.com/webkitbug2.html.

The bug is caused by the "<" character in webkitbug1.html's string variable temp.
When the created script element is appended, its innerHTML treats /<.*>/ as HTML tags.
And this causes the error.
Comment 1 Alexey Proskuryakov 2009-12-27 18:03:37 PST
An obvious workaround is to use textContent instead of innerHTML (innerText also works, but it's not supported by Firefox).
Comment 2 Alexey Proskuryakov 2009-12-27 18:04:13 PST
Created attachment 45539 [details]
test case
Comment 3 Alexey Proskuryakov 2010-01-07 17:22:21 PST
Created attachment 46100 [details]
proposed fix

This fixes the problem for SCRIPT and STLYE elements (actually, we didn't support setting innerHTML for style at all before). I'm not sure if any other elements need this treatment - Firefox behavior seems somewhat confused, as it applies it to NOSCRIPT for whatever reason.
Comment 4 WebKit Review Bot 2010-01-07 17:25:39 PST
style-queue ran check-webkit-style on attachment 46100 [details] without any errors.
Comment 5 Alexey Proskuryakov 2010-01-08 16:30:35 PST
Committed <http://trac.webkit.org/changeset/53023>.