Content can escape out of CSS & script
Open
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 233
- Forks
- 61
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 82
Description
What information was incorrect, unhelpful, or incomplete?
I didn't expect </style>/</script> to escape me out of the expected content.
What did you expect to see?
I expected to remain in CSS/script, as I would if I was editing external files.
Although codepen does this too, so maybe it isn't a big deal.
Do you have any supporting links, references, or citations?
No response
Do you have anything more you want to share?
I encountered this when using </script> within a string in some script.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open the linked MDN Playground reproduction first and compare its CSS and script handling with editing equivalent external files. Trace the frontend path responsible for embedding or parsing that content, then verify that literal closing tags in CSS or script remain within the expected context without breaking the surrounding document.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- css, javascript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100