Git Product home page Git Product logo

Comments (8)

WebReflection avatar WebReflection commented on June 2, 2024

there is only one tag you can't have within a <script> and that's </script> ... because it closes the opening one.

This is not PyScript, this is how Web standards work and the only caveat around data elements (namely: script).

If you change that huge triple quoted string at the very end using <\x2fscript> instead of </script> nothing different should happen.

The \x2f char represents / but it doesn't bother the browser as that's just code within a code related tag.

Bear in mind injecting scripts via strings is XSS error prone and it might even be disabled by browsers + keep in mind you cannot inject whole pages into an element ... elements are not iframes so expect issues (due Web standars) there too.

This is impossible to fix code-wise because we don't get to change the browser parsing behavior here.

from pyscript.

WebReflection avatar WebReflection commented on June 2, 2024

Closing as there's no follow-up action from our side, beside eventually documenting this but nothing we can ever fix.

If you have any follow up question, feel free to ask.

from pyscript.

WebReflection avatar WebReflection commented on June 2, 2024

To whom it might concern, this is issue is the equivalent of:

<script>
  console.log(`
    <script>nope</script>
  `);
</script>

That cannot work on the Web, but this can:

<script>
  console.log(`
    <script>nope<\x2fscript>
  `);
</script>

You can see even GitHub highlighter goes bananas with the former example.

from pyscript.

nasrin1748 avatar nasrin1748 commented on June 2, 2024

Indeed it still works this way.
https://_12.pyscriptapps.com/soft-paper/latest/

from pyscript.

WebReflection avatar WebReflection commented on June 2, 2024

@nasrin1748 your example uses an external file ... that never interferes with the parsing of the DOM within the browser.

Please note that this is not an opinion of mine, this is how the Web standards work.

If you write </script> inside a <script></script> tag and that's not the closing tag you will have errors in a way or another. The script is indeed meant as non-processing node/instruction and it ignores everything until the closing tag.

If you were referring to something else like putting a DOCTYPE node with html and body inside a <div> I am telling you that's not doing what you think it's doing ... and this is also defined by Web standards.

If you need any other clarification feel free to ask.

from pyscript.

WebReflection avatar WebReflection commented on June 2, 2024

P.S. to explain further the issue, it's the exact same with multi line coments:

/**
 * if you put */ here that's it
 */

See the broken highlight or try it in any JS, C, or any other PL context and see the result is not what you meant.

from pyscript.

nasrin1748 avatar nasrin1748 commented on June 2, 2024

Do ipywidgets work in pyscript?

from pyscript.

WebReflection avatar WebReflection commented on June 2, 2024

we have a discord channel for questions related to PyScript. Let's please not discuss unrelated topics in here so that others might read or answer without needing to read into unrelated issues, thank you!

from pyscript.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.