Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to safely escape JSON inside HTML SCRIPT elements

sirre.al

Post reply on HN
Print view View original

21–30 of 47 posts

Re: How to safely escape JSON inside HTML SCRIPT elements

#21

Post by socalgal2 »

tannhaeuser wrote: post #14
dmsnell wrote: post #8

Earlier quoted context omitted.

The other comment explains this, but I think it can also be viewed differently. It’s helpful to recognize that the inner script tags are not actual script tags. Yes, once entering a script element, the browser switches parsers and wants to skip everything until a closing script tag appears. The STYLE element, TITLE, TEXTAREA, and a few others do this. Once they chop up the HTML like this they send the contents to the…

Whoever the idiot was who came up with piling inline CSS and JS into the already heavy SGML syntax of HTML should've considered his career choices. It would've be perfectly adequate to require script and CSS to be put into external "resources" linked via src/href, especially since the spec proposals operated under the assumption there would be multiple script and styling languages going forward (like, hey, if we have…

All of those are features, not bugs and I'm glad they are there. Uploading and dealing with 1 file is much nicer than dealing with several.

Re: How to safely escape JSON inside HTML SCRIPT elements

#22

Post by themafia »

domenicd wrote: post #20
themafia wrote: post #17

Earlier quoted context omitted.

You can write: Which is a little weird. At the very least I'd expect the type="module" documentation to say that `charset`, `defer` and `nomodule` attributes have no effect.

It does? https://html.spec.whatwg.org/multipage/scripting.html#attr-s...

It specifies it in the abstract. Did you mean to link here instead of to the 'src' attribute documentation?

https://html.spec.whatwg.org/multipage/scripting.html#attr-s....

My expectation was that this condition would have been reflected in MDNs documentation where it breaks the conditions for 'charset' and 'defer' out.

Re: How to safely escape JSON inside HTML SCRIPT elements

#23

Post by jiggawatts »

socalgal2 wrote: post #21
tannhaeuser wrote: post #14

Earlier quoted context omitted.

Whoever the idiot was who came up with piling inline CSS and JS into the already heavy SGML syntax of HTML should've considered his career choices. It would've be perfectly adequate to require script and CSS to be put into external "resources" linked via src/href, especially since the spec proposals operated under the assumption there would be multiple script and styling languages going forward (like, hey, if we have…

All of those are features, not bugs and I'm glad they are there. Uploading and dealing with 1 file is much nicer than dealing with several.

> much nicer than dealing with several.

"My momentary convenience trumps the man-millenia of effort required to protect billions of people from script injection attacks."

Re: How to safely escape JSON inside HTML SCRIPT elements

#24

Post by jgalt212 »

o11c wrote: post #4
comex wrote: post #3

If you're evaluating JSON as JavaScript, you also need to make sure none of the objects have a key named "__proto__", or else you can end up with some strange results. (This is related to the 'prototype pollution' attack, although searching that phrase will mostly give you information about the more-dangerous variant where two objects are being merged together with some JS library. If __proto__ is just part of a lite…

But note that there's also ` ` these days (usually only useful with `id=`) ... and `importmap` I guess.

Why does the author ignore this method? Django docs show this as a best practice via a built in tag.

Re: How to safely escape JSON inside HTML SCRIPT elements

#25

Post by masklinn »

themafia wrote: post #17
masklinn wrote: post #16

Earlier quoted context omitted.

> My favorite is type="module" which competes with the higher level attribute nomodule="true". Anyways it looks like has taken a lot of abuse over the years: It "conflicts" in the same way noscript[1] and script "conflict" no? They're basically related features, but can't really be made exclusive because the mere act of trying to do so wouldn't work: as the link indicates, executing code in a !module browser reserves…

You can write: Which is a little weird. At the very least I'd expect the type="module" documentation to say that `charset`, `defer` and `nomodule` attributes have no effect.

> You can write:

Yes, and you can write

    
        
             ...

Re: How to safely escape JSON inside HTML SCRIPT elements

#26

Post by masklinn »

themafia wrote: post #22
domenicd wrote: post #20

Earlier quoted context omitted.

It does? https://html.spec.whatwg.org/multipage/scripting.html#attr-s...

It specifies it in the abstract. Did you mean to link here instead of to the 'src' attribute documentation? https://html.spec.whatwg.org/multipage/scripting.html#attr-s... . My expectation was that this condition would have been reflected in MDNs documentation where it breaks the conditions for 'charset' and 'defer' out.

Why? MDN does not purport to be exhaustive, that's the spec's job.

Re: How to safely escape JSON inside HTML SCRIPT elements

#27

Post by porridgeraisin »

jiggawatts wrote: post #23
socalgal2 wrote: post #21

Earlier quoted context omitted.

All of those are features, not bugs and I'm glad they are there. Uploading and dealing with 1 file is much nicer than dealing with several.

> much nicer than dealing with several. "My momentary convenience trumps the man-millenia of effort required to protect billions of people from script injection attacks."

Not just his convenience. Man-millenia of convenience, if you will ;) I too love the fact that many things can be single index.html's, no need of a zip file then. It's double-click to view. One of the best things about the web platform.

Edit: and "effort", please. The spec has a simple and clear note:

> The easiest and safest way to avoid the rather strange restrictions described in this section is to always escape an ASCII case-insensitive match for "Backwards compatibility is easily and completely worth this small amount of effort. It's a one-liner in most languages.

Re: How to safely escape JSON inside HTML SCRIPT elements

#28

Post by TOGoS »

forty wrote: post #13
TOGoS wrote: post #11

> Not so fast, things are about to get messy That ship sailed several paragraphs ago, when got special treatment by the HTML parser. Too bad we couldn't all agree to parse consistently, or, you know, just &-escape the text like we do /everywhere else/ in HTML.

What's wrong with CDATA? Do you have concrete examples when that would not work?

As per the 'special parsing rules for script tags', browsers don't actually treat it as what you'd expect it means.

  console.log("");
Results in this being output to the console:
Browsers don't do what you intend if you wrap the whole script in CDATA, either. They treat the "I tend to use them anyway, as sort of a HTML/XHTML polyglot thing, because deep in my heart I still think HTML should be valid XML:

  /*  */
In summary, the 'special parsing rules for script tags' add a great amount of complexity not just to the parsing code, but for anybody who has to emit markup, especially if different parsers disagree on what kind of escaping rules are active within a given section. Yes, the HTML5 spec codified the neurotypical "I would rather make you guess what I mean than just use the proper words to say it clearly" behavior, so at least browsers agree on it, but it's a mess and a pain to deal with because now you have to remember 1000 exceptions to what would have been simple rules.

Re: How to safely escape JSON inside HTML SCRIPT elements

#29

Post by tannhaeuser »

porridgeraisin wrote: post #27
jiggawatts wrote: post #23

Earlier quoted context omitted.

> much nicer than dealing with several. "My momentary convenience trumps the man-millenia of effort required to protect billions of people from script injection attacks."

Not just his convenience. Man-millenia of convenience, if you will ;) I too love the fact that many things can be single index.html's, no need of a zip file then. It's double-click to view. One of the best things about the web platform. Edit: and "effort", please. The spec has a simple and clear note: > The easiest and safest way to avoid the rather strange restrictions described in this section is to always escape a…

The easiest and safest way to avoid the rather strange restrictions described is to not make use of inline script in a way that makes those restrictions neccessary, though. And a "recommendation" should reflect that (from back when HTML recommendations were actually published rather than random Google shills writing whatever on github). The suggested workaround is also not without criticism (eg [1]).

[1]: https://uploadcare.com/blog/vulnerability-in-html-design/

Re: How to safely escape JSON inside HTML SCRIPT elements

#30

Post by themafia »

masklinn wrote: post #26
themafia wrote: post #22

Earlier quoted context omitted.

It specifies it in the abstract. Did you mean to link here instead of to the 'src' attribute documentation? https://html.spec.whatwg.org/multipage/scripting.html#attr-s... . My expectation was that this condition would have been reflected in MDNs documentation where it breaks the conditions for 'charset' and 'defer' out.

Why? MDN does not purport to be exhaustive, that's the spec's job.

MDN does a pretty good job anyways. Perhaps I feel that it would be in keeping with that spirit to have this condition documented. This is partly because MDN is far easier to read for the purposes of _reference_ than the spec which is easier to read for the purposes of _implementing_. It's also easier to search and to share links to, as the link you presented earlier was both wrong and confusing, and there was no natural way to link to the part of the document you intended.

Perhaps the spec isn't the right tool for every job? That's why, for me, at least.

Post reply on HN