diplodoc-platform / diplodoc-platform/transform

Tag SCRIPT breaks whole document

Open
#652 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
69
Forks
59
Avg merge
1d 21h
Merged PRs (30d)
6

Description

### Package version

4.47.3

### Node version

20.16

### Platform

mac

### What steps will reproduce the bug?

```yaml
allowHTML: true
needToSanitizeHtml: false
```

If you use html in a page + allow inserting script, the page becomes broken. You insert all the content into the script tag at the end of the document

```md
# Example 1
bla()
```
After build this script will be inside another script in the end of the page

```html

window.STATIC_CONTENT = true
window.__DATA__ = {"data": ...., html: "...<script>bla()"

```
when the browser parser encounters another script tag inside, it thinks that the first one has ended.

### What is the expected behavior?

For documentation it is often important to include examples, I would like to be able to include a script tag

### What do you see instead?

Broken page

### Additional information

I also couldn't find what format the sanitizer options are (sanitizeOptions). The documentation just says Object.
I think it should be like this:

```yaml
allowHTML: true
needToSanitizeHtml: true
sanitizeOptions:
allowedTags:
- script
```
But this does't work

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with the shown allowHTML and needToSanitizeHtml settings and the sample Markdown containing a script tag. Then inspect the sanitizer configuration and documentation, including sanitizeOptions; done means the generated page remains valid while the intended script-tag behavior is clearly defined and tested.

Written by the indexing model from the issue text.

Assessment

Tech stack
markdown, typescript
Domain
security, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.