search

cobrateam / django-htmlmin

HTML minifier for Python frameworks (not only Django, despite the name).
http://pypi.python.org/pypi/django-htmlmin
BSD 2-Clause "Simplified" License
542 stars 73 forks source link

Minify closes <form> tag erroneously #134

Open LuisFGomez opened 5 years ago

LuisFGomez commented 5 years ago

In my case, I have a form that's rendered inside a bootstrap 3 panel. Here's a simple example you can run through pyminify:

<html>
    <head></head>
    <body>
        <div class="panel panel-default">
            <div class="panel-heading">
                <h4>Perform this action?</h4>
            </div><!-- panel-heading -->
            <div class="panel-body">
                <p>Would you like to perform this action?</p>
                <form action="/some/url/" method="POST">
                    <input name="csrfmiddlewaretoken" type="hidden" value="fakecsrftokenvalue"/>
                    <input name="somekey" type="hidden" value="someval"/>
            </div><!-- panel-body -->
            <div class="panel-footer text-right">
                <div class="form-group">
                    <input class="btn btn-primary" type="submit" value="Yes!"/>
                </div><!-- form-group -->
                </form>
            </div><!-- panel-footer -->
        </div><!-- panel -->
    </body>
</html>

The output is

<html><head></head><body><div class="panel panel-default"><div class="panel-heading"><h4>Perform this action?</h4></div><div class="panel-body"><p>Would you like to perform this action?</p><form action="/some/url/" method="POST"><input name="csrfmiddlewaretoken" type="hidden" value="fakecsrftokenvalue"/><input name="somekey" type="hidden" value="someval"/></form></div><div class="panel-footer text-right"><div class="form-group"><input class="btn btn-primary" type="submit" value="Yes!"/></div></div></div></body></html>

This places the closing </form> tag immediately after the second <input> tag, which excludes the submit button from the form. This breaks the form entirely.

germn commented 5 years ago 
        <div class="panel-body">
            <p>Would you like to perform this action?</p>
            <form action="/some/url/" method="POST">
                <input name="csrfmiddlewaretoken" type="hidden" value="fakecsrftokenvalue"/>
                <input name="somekey" type="hidden" value="someval"/>
        </div><!-- panel-body -->

panel-body must either be closed before form tag opened or after it is closed. Otherwise it's undefined what's your html mean. html parser can't nor shouldn't provide any guarantee for invalid html.