[whatwg] Unterminated comments in , <script>, <style>, <title>, and <iframe></span></a></span> </h1> <p class="darkgray font13"> <span class="sender pipe"><a href="/search?l=whatwg@lists.whatwg.org&q=from:%22Adam+Barth%22" rel="nofollow"><span itemprop="author" itemscope itemtype="http://schema.org/Person"><span itemprop="name">Adam Barth</span></span></a></span> <span class="date"><a href="/search?l=whatwg@lists.whatwg.org&q=date:20080626" rel="nofollow">Thu, 26 Jun 2008 22:12:34 -0700</a></span> </p> </div> <div itemprop="articleBody" class="msgBody"> <!--X-Body-of-Message--> <pre>Recently, I've been testing how browser parsers handle unterminated <!-- comments -->. Internet Explorer 7, Firefox 3, Safari 3.1, and Opera 9.5 agree on the following cases:</pre><pre> <a rel="nofollow" href="http://crypto.stanford.edu/~abarth/research/html5/comments/open-textarea.html">http://crypto.stanford.edu/~abarth/research/html5/comments/open-textarea.html</a> <a rel="nofollow" href="http://crypto.stanford.edu/~abarth/research/html5/comments/open-script.html">http://crypto.stanford.edu/~abarth/research/html5/comments/open-script.html</a> <a rel="nofollow" href="http://crypto.stanford.edu/~abarth/research/html5/comments/open-style.html">http://crypto.stanford.edu/~abarth/research/html5/comments/open-style.html</a> Essentially, they treat the <!-- as if it did not start a comment. Ian pointed out on IRC that this might be a security vulnerability because the result of parsing the stream depends on whether the parser hung or terminated at the end of the stream. (If the parser had hung, it would be awaiting more characters for the comment.) The above browsers almost agree for on the behavior for <title>: <a rel="nofollow" href="http://crypto.stanford.edu/~abarth/research/html5/comments/open-title.html">http://crypto.stanford.edu/~abarth/research/html5/comments/open-title.html</a> Internet Explorer 7, Firefox 3, and Opera 9.5 treat treat <!-- as if it did not start a comment. Safari 3.1 differs slightly and only uses the portion before the <!-- as the title, but otherwise parses the remainder of the document as if <!-- did not start a comment. The above browsers differ in their handling of unterminated comments for the <iframe> element: <a rel="nofollow" href="http://crypto.stanford.edu/~abarth/research/html5/comments/open-iframe.html">http://crypto.stanford.edu/~abarth/research/html5/comments/open-iframe.html</a> Internet Explorer 7 and Safari 3.1 follow the spec and consume the remainder of the document in the comment. Firefox 3 and Opera 9.5 treat <!-- as if it did not start a comment. As I understand it, browser behavior for <textarea>, <script>, <style>, and <title> differs from the spec. It is unclear whether browsers will change to match the spec, especially because the <script> element might contain <!-- sequences in string literals or regular expressions (e.g., <<a rel="nofollow" href="http://crypto.stanford.edu/~abarth/research/html5/comments/open-script-in-string.html">http://crypto.stanford.edu/~abarth/research/html5/comments/open-script-in-string.html</a>>). Adam </pre> </div> <div class="msgButtons margintopdouble"> <ul class="overflow"> <li class="msgButtonItems"><a class="button buttonleft " accesskey="p" href="msg10319.html">Previous message</a></li> <li class="msgButtonItems textaligncenter"><a class="button" accesskey="c" href="index.html#10324">View by thread</a></li> <li class="msgButtonItems textaligncenter"><a class="button" accesskey="i" href="maillist.html#10324">View by date</a></li> <li class="msgButtonItems textalignright"><a class="button buttonright " accesskey="n" href="msg10325.html">Next message</a></li> </ul> </div> <a name="tslice"></a> <div class="tSliceList margintopdouble"> <ul class="icons monospace"> </ul> </div> <div class="overflow msgActions margintopdouble"> <div class="msgReply" > <h2> Reply via email to </h2> <form method="POST" action="/mailto.php"> <input type="hidden" name="subject" value="[whatwg] Unterminated comments in <textarea>, <script>, <style>, <title>, and <iframe>"> <input type="hidden" name="msgid" value="7789133a0806262212y19c3aadcl5560c23442856bdf@mail.gmail.com"> <input type="hidden" name="relpath" value="whatwg@lists.whatwg.org/msg10324.html"> <input type="submit" value=" Adam Barth "> </form> </div> </div> </div> <div class="aside" role="complementary"> <div class="logo"> <a href="/"><img src="/logo.png" width=247 height=88 alt="The Mail Archive"></a> </div> <form class="overflow" action="/search" method="get"> <input type="hidden" name="l" value="whatwg@lists.whatwg.org"> <label class="hidden" for="q">Search the site</label> <input class="submittext" type="text" id="q" name="q" placeholder="Search whatwg"> <input class="submitbutton" name="submit" type="image" src="/submit.png" alt="Submit"> </form> <div class="nav margintop" id="nav" role="navigation"> <ul class="icons font16"> <li class="icons-home"><a href="/">The Mail Archive home</a></li> <li class="icons-list"><a href="/whatwg@lists.whatwg.org/">whatwg - all messages</a></li> <li class="icons-about"><a href="/whatwg@lists.whatwg.org/info.html">whatwg - about the list</a></li> <li class="icons-expand"><a href="/search?l=whatwg@lists.whatwg.org&q=subject:%22%5C%5Bwhatwg%5C%5D+Unterminated+comments+in+%3Ctextarea%3E%2C+%3Cscript%3E%2C+%3Cstyle%3E%2C%09%3Ctitle%3E%2C+and+%3Ciframe%3E%22&o=newest&f=1" title="e" id="e">Expand</a></li> <li class="icons-prev"><a href="msg10319.html" title="p">Previous message</a></li> <li class="icons-next"><a href="msg10325.html" title="n">Next message</a></li> </ul> </div> <div class="listlogo margintopdouble"> </div> <div class="margintopdouble"> </div> </div> </div> <div class="footer" role="contentinfo"> <ul> <li><a href="/">The Mail Archive home</a></li> <li><a href="/faq.html#newlist">Add your mailing list</a></li> <li><a href="/faq.html">FAQ</a></li> <li><a href="/faq.html#support">Support</a></li> <li><a href="/faq.html#privacy">Privacy</a></li> <li class="darkgray">7789133a0806262212y19c3aadcl5560c23442856bdf@mail.gmail.com</li> </ul> </div> </body> </html> <script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'9faa07c3ba02cb43',t:'MTc3ODU5NTI3Mg=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script>