diplodoc-platform / diplodoc-platform/transform
Tag SCRIPT breaks whole document
- Dominant language
- TypeScript
- Stars
- 69
- Forks
- 59
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 6
Description
### Package version
4.47.3
### Node version
20.16
### Platform
mac
### What steps will reproduce the bug?
```yaml
allowHTML: true
needToSanitizeHtml: false
```
If you use html in a page + allow inserting script, the page becomes broken. You insert all the content into the script tag at the end of the document
```md
# Example 1
bla()
```
After build this script will be inside another script in the end of the page
```html
window.STATIC_CONTENT = true
window.__DATA__ = {"data": ...., html: "...<script>bla()"
```
when the browser parser encounters another script tag inside, it thinks that the first one has ended.
### What is the expected behavior?
For documentation it is often important to include examples, I would like to be able to include a script tag
### What do you see instead?
Broken page
### Additional information
I also couldn't find what format the sanitizer options are (sanitizeOptions). The documentation just says Object.
I think it should be like this:
```yaml
allowHTML: true
needToSanitizeHtml: true
sanitizeOptions:
allowedTags:
- script
```
But this does't work
Contributor guide
Research direction
Start by reproducing the issue with the shown allowHTML and needToSanitizeHtml settings and the sample Markdown containing a script tag. Then inspect the sanitizer configuration and documentation, including sanitizeOptions; done means the generated page remains valid while the intended script-tag behavior is clearly defined and tested.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- markdown, typescript
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100