From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <eklhad@comcast.net>
Received: from resqmta-ch2-09v.sys.comcast.net
 (resqmta-ch2-09v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:41])
 by hurricane.the-brannons.com (Postfix) with ESMTPS id 619CB783A6
 for <edbrowse-dev@lists.the-brannons.com>;
 Sat, 12 Sep 2015 18:19:31 -0700 (PDT)
Received: from resomta-ch2-18v.sys.comcast.net ([69.252.207.114])
 by resqmta-ch2-09v.sys.comcast.net with comcast
 id GRMm1r0022Udklx01RNEqT; Sun, 13 Sep 2015 01:22:14 +0000
Received: from eklhad ([IPv6:2601:405:4002:b0a:21e:4fff:fec2:a0f1])
 by resomta-ch2-18v.sys.comcast.net with comcast
 id GRND1r00E0GArqr01RNDld; Sun, 13 Sep 2015 01:22:14 +0000
To: Edbrowse-dev@lists.the-brannons.com
From: Karl Dahlke <eklhad@comcast.net>
Reply-to: Karl Dahlke <eklhad@comcast.net>
User-Agent: edbrowse/3.5.4.2+
Date: Sat, 12 Sep 2015 21:22:13 -0400
Message-ID: <20150812212213.eklhad@comcast.net>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net;
 s=q20140121; t=1442107334;
 bh=18jWn1Et5FyRqGZ7r985lH+IWsei1G5/rk7MArBc5Ng=;
 h=Received:Received:To:From:Reply-to:Subject:Date:Message-ID:
 Mime-Version:Content-Type;
 b=VA+6Lzzj+f/pqTzvM+Drti4hkFE5bigfTKAlBR64zOVoF/u5DsnuJGSfgrQogSq2g
 dZJ3LohqLaOY9z+PmaGV6kNIFq+I3fLFbKVb1j1o942YJLhTp9HOsQ3fZiZ/aA9ei5
 EYE7QcXFsL14KFWO3H2XQY8rPO92ChojCSEW3ToS+iu/ALgTLtDV1KKs9H1zFO25CG
 lUTLfFlC1/GaGA5wBXwWECMaX5s4VWDwlbc/+/34gTMymOF1DQqvKmjiJlS2C2P7zT
 Jlk/PRWU0Ekc3cT3e+p/1074E3uSf+Xvo1LmKZ2un/GSfFF4vKej9iZJt+JtkNqyC+
 Y+7dI522kpBvA==
Subject: [Edbrowse-dev] tidy script bug workaround
X-BeenThere: edbrowse-dev@lists.the-brannons.com
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Edbrowse Development List <edbrowse-dev.lists.the-brannons.com>
List-Unsubscribe: <http://lists.the-brannons.com/mailman/options/edbrowse-dev>, 
 <mailto:edbrowse-dev-request@lists.the-brannons.com?subject=unsubscribe>
List-Archive: <http://lists.the-brannons.com/mailman/private/edbrowse-dev/>
List-Post: <mailto:edbrowse-dev@lists.the-brannons.com>
List-Help: <mailto:edbrowse-dev-request@lists.the-brannons.com?subject=help>
List-Subscribe: <http://lists.the-brannons.com/mailman/listinfo/edbrowse-dev>, 
 <mailto:edbrowse-dev-request@lists.the-brannons.com?subject=subscribe>
X-List-Received-Date: Sun, 13 Sep 2015 01:19:31 -0000

Well if they've been talking about this bug since 2007,
then they might not fix it soon.
With that in mind I was thinking about a preprocessing workaround.
My first attempt looked for strings within scripts,
and then <script within a string,
but that was completely derailed by
	if(whatever.match(/"/)) { do stuff }
The bare regexps make this approach impossible.
So I made the routine even simpler, and I think safer and better.
If it flags a false positive, then the script won't compile and won't run,
which is better than running and doing the wrong thing.
Normally I just push stuff without review,
in the interest of getting things done,
which is perhaps arrogant, and I apologize for that,
but this one I think people should look at first.
It is ready to push if you say go.
The new string is longer than the original,
so I have to use all those dynamic string functions.

/* Work around a nasty bug in tidy5 wherein "<script>" anywhere
 * in a javascript will totally derail things.
 * I turn < into \x3c. */
static char *escapeLessScript(const char *htmltext)
{
	char *ns;		/* new string */
	int ns_l;
	const char *s1, *s2;	/* start and end of script */
	const char *lw;		/* last write */
	const char *q;		/* inner script */

	ns = initString(&ns_l);
	lw = htmltext;

	while (true) {
		s1 = strstrCI(lw, "<script");
		if (!s1)
			break;
//  printf("@@%s", s1);
		s1 += 7;
		if (isalnumByte(*s1)) {	/* <scriptx */
			stringAndBytes(&ns, &ns_l, lw, s1 - lw);
			lw = s1;
			continue;
		}
		s2 = strstrCI(s1, "</script");
		if (!s2)
			goto abort;

/* script now has a start and end */
		stringAndBytes(&ns, &ns_l, lw, s1 - lw);
		lw = s1;

		while (true) {
			q = strstrCI(lw, "<script");
			if (!q || q > s2)
				break;
			stringAndBytes(&ns, &ns_l, lw, q - lw);
			stringAndString(&ns, &ns_l, "\\x3c");
			lw = q + 1;
		}

		stringAndBytes(&ns, &ns_l, lw, s2 - lw);
		lw = s2;
	}

	stringAndString(&ns, &ns_l, lw);
	return ns;

abort:
	nzFree(ns);
	return 0;
}				/* escapeLessScript */