Restrictions for contents of script elements (_object-create.js)

[sinisterstumble]

In-lining the core-js/library/modules/_object-create.js in html <script> tag may theoretically backfire, _object-create.js has <script> tags in the source.

Should this be adressed ?

Restrictions for contents of script elements

The easiest and safest way to avoid the rather strange restrictions described in this section is to always escape "<!--" as "<!--", "<script" as "<\script", and "</script" as "</script" when these sequences appear in literals in scripts (e.g. in strings, regular expressions, or comments), and to avoid writing code that uses such constructs in expressions. Doing so avoids the pitfalls that the restrictions in this section are prone to triggering: namely, that, for historical reasons, parsing of script blocks in HTML is a strange and exotic practice that acts unintuitively in the face of these sequences.

_object-create.js#L23

  iframeDocument.open();
  iframeDocument.write('<script>document.F=Object</script' + gt);
  iframeDocument.close();

[zloirock]

We had a problem with </script>, so now it's splitted, but not with <script>. Anyway, just in case, I'll fix this issue later.

[sinisterstumble]

Would you accept a PR ?

On 06/03, Denis Pushkarev wrote:

We had a problem with </script>, so now it's splitted, but not with <script>. Anyway, just in case, I'll fix this issue later.

---

You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub:
#204 (comment)

[zloirock]

Sure.