Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Parser will extract script tags in script tags and bork the parent script #92

Open
tbeseda opened this issue Aug 2, 2023 · 2 comments

Comments

@tbeseda
Copy link
Contributor

tbeseda commented Aug 2, 2023

Sounds wild, I know. And it's a bit of an edge case.
But if you have a script tag in an element definition, and then in that script tag you have a string that contains an open or close "<script>", the parser gets eager to start extracting scripts.

Here's a sample <my-element> that will blow up in the browser -- server render works, or at least doesn't throw

export default function ({ html }) {
  return html`
    <h1 class="text4 font-mono">my-element</h1>

    <script>
      console.log('start.')

      // this string will trip up the parser
      const someHTML2 = '<script>window.$$ = "$$";</script>'

      console.log('done.')
    </script>
  `
}

and here's a screenshot of what is rendered

image

@tbeseda
Copy link
Contributor Author

tbeseda commented Aug 2, 2023

And if you're wondering how I got here: I have blobs of text (blog posts) that often contain code-like content but are not actually code to be executed.
These blobs are sometimes loaded into an editor in the browser, so I hydrate that content via a top-level script tag like

<blog-editor></blog-editor>
<script>
window.editingBlogPost = `${someStringFromTheDatabase}`
</script>

so I'm not actually authoring a script in a script, it's just string content from the db.

@kristoferjoseph
Copy link
Contributor

Ooh this is a good one!
Thanks for finding it.
I guess my parsing will need to be smarter... or dumber, definitely less greedy.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants