search

fxbois / web-mode

web template editing mode for emacs
https://web-mode.org
GNU General Public License v3.0
1.63k stars 262 forks source link

closing script tag inside string in inline JavaScript script tag break highlighting #1223

Closed jcubic closed 2 years ago

jcubic commented 2 years ago

I have this code:

    const script = '</script>';

And this closes the beginning of the script even though it's inside a string.

I'm not sure how hard it would be to handle this case. I'm not able to find a similar issue.

UwUnyaa commented 2 years ago

I've ran into this issue over the years too. Your best bet might be to try to escape some characters to avoid such parsing, but it's definitely a bug in web-mode.

YoloClin commented 2 years ago

</script> cannot be stored as a string within Browser engines, https://jsfiddle.net/nwz7bkfd/ for a web poc, but it also fails when served / accessed natively.

You can work around the issue by using const script = '</' + 'script>';. However, I'd suggest that you should avoid dynamically generated JavaScript, as it can lead to XSS and probably RCE in node-land. A better approach would be to use static JavaScript coupled with JSON blobs for dynamic content.

jcubic commented 2 years ago

@YoloClin I'm generating HTML code that includes external dependencies for my JavaScript playground. It seems that you're right, I didn't check if it works, I completely forget that this syntax is invalid.