[Edbrowse-dev] tag attributes in edbrowse DOM

[Edbrowse-dev] tag attributes in edbrowse DOM

[Karl Dahlke]

> So they are overloading the <script> tag?

I think they have done so almost from the begining.

> Is edbrowse also trying to execute things that it should not

I don't believe so.
If the language attribute is given I require it to say javascript.
	<script language=javascript>
If no language attribute is given I assume javascript,
which is what the documentation says to do.
It's possible that I should also be checking the type attribute.


Karl Dahlke

Re: [Edbrowse-dev] tag attributes in edbrowse DOM

[Adam Thompson]

[-- Attachment #1: Type: text/plain, Size: 1162 bytes --]

On Thu, Jul 31, 2014 at 03:27:18AM -0400, Karl Dahlke wrote:
> > So they are overloading the <script> tag?
> 
> I think they have done so almost from the begining.

Yeah probably. The developper of the syntax highlighter software even says not
to use this method in environments (like blog posts which may be converted to rss etc)
where the script tags may be stripped out.
The reason they're doing it is due to the fact that whatever's in the script
tag doesn't require html escaping.

> > Is edbrowse also trying to execute things that it should not
> 
> I don't believe so.
> If the language attribute is given I require it to say javascript.
> 	<script language=javascript>
> If no language attribute is given I assume javascript,
> which is what the documentation says to do.
> It's possible that I should also be checking the type attribute.

Yes we should if it exists.
However, even though edbrowse is registering these tags as containing javascript, when using the syntax highlighter in this mode one uses a CDATA
section to surround the data, and thus I think edbrowse isn't parsing the contents of these tags.

Cheers,
Adam.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [Edbrowse-dev] tag attributes in edbrowse DOM

[Chris Brannon]

Adam Thompson <arthompson1990@gmail.com> writes:

> This script uses the <script> tag in a strange way,
> essentially to store code without html escaping it.
> I think it then accesses the DOM to look for the special "syntaxhighlighter"
> type attribute of script tags then renders this content.

Hi Adam,
So they are overloading the <script> tag?  Is edbrowse also trying to execute
things that it should not be executing?

-- Chris

Re: [Edbrowse-dev] tag attributes in edbrowse DOM

[Adam Thompson]

[-- Attachment #1: Type: text/plain, Size: 2058 bytes --]

On Thu, Jul 24, 2014 at 11:43:17AM -0400, Karl Dahlke wrote:
> > we don't currently support the type attribute for script tags
> 
> Well I was able to change this in 2 lines of code, so I did.
> type and language are now present in the script object.
> See if that helps, or perhaps another small
> incremental change is needed.

Thanks. I think this syntax highlighter thing also needs the brush attribute,
which definitely isn't standard (at least not that I've heard of).
It probably also needs other DOM things which I've yet to run into,
but we won't know until it tries to do whatever with the script tags.
Really I need to sit down and go through the syntax highlighter code to work
out what it does, but that'll take time.

> > I was wondering how difficult it would be to load all attributes for tags
> > into the DOM, not just the ones which have direct effect on the browser.
> 
> Well I've wanted to do this for a long time.
> It would have been easy, if I had done it from the start.
> Now I could still do it but the hard part would be taking out
> all the places all over the code where I look for and store certain attributes.
> Or maybe it's ok to store them twice I'd have to look into that.
> Anyways it is something we definitely want to do someday.

Hmmm, if it's just loading into the DOM then that's probably done by
establish_property_string right? If so can we shove a debug print in there
(possibly only printing on a higher debug level),
then use that to help us find the duplicate settings.
The target would be to remove all such duplication warnings,
and then the debug print itself, but it may help ease the process.
It's also possibly fairly mechanical anyway (search for the function which gets
the attribute, then remove the various lines below it)
or maybe I'm just over-simplifying things a bit.

Also, how do we handle CDATA sections currently,
since this syntax highlighter stuff uses them within the special script tags to
store the code to be syntax highlighted?

Cheers,
Adam.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

[Edbrowse-dev] tag attributes in edbrowse DOM

[Karl Dahlke]

> we don't currently support the type attribute for script tags

Well I was able to change this in 2 lines of code, so I did.
type and language are now present in the script object.
See if that helps, or perhaps another small
incremental change is needed.

> I was wondering how difficult it would be to load all attributes for tags
> into the DOM, not just the ones which have direct effect on the browser.

Well I've wanted to do this for a long time.
It would have been easy, if I had done it from the start.
Now I could still do it but the hard part would be taking out
all the places all over the code where I look for and store certain attributes.
Or maybe it's ok to store them twice I'd have to look into that.
Anyways it is something we definitely want to do someday.

Karl Dahlke

[Edbrowse-dev] tag attributes in edbrowse DOM

[Adam Thompson]

[-- Attachment #1: Type: text/plain, Size: 1184 bytes --]

Hi all,

Whilst browsing various documentation stored in Atlassian's Confluence wiki
system [1], I noticed that most of the code examples weren't showing up.
Closer investigation shows they use something which looks like a version of the Syntax Highlighter script
[2] when generating code examples.

This script uses the <script> tag in a strange way,
essentially to store code without html escaping it.
I think it then accesses the DOM to look for the special "syntaxhighlighter"
type attribute of script tags then renders this content.
It also requires a special brush attribute for these tags.
Obviously, since we don't currently support the type attribute for script tags
(that I can see) and certainly don't support arbitrary attributes,
this doesn't work.

I was wondering how difficult it would be to load all attributes for tags into
the DOM, not just the ones which have direct effect on the browser.
I've no idea if this would fix the non-functioning syntax highlighter script (I
suspect probably not), but it would give us a more standard DOM representation.

Cheers,
Adam.
[1] https://www.atlassian.com/software/confluence
[2] http://alexgorbatchev.com/SyntaxHighlighter/

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]