Ticket #10410 (closed Bug: fixed)

Opened 5 years ago

Last modified 3 years ago

plone.formwidget.autocomplete: Javascript should be wrapped in a CDATA section

Reported by: rockdj Owned by: optilude
Priority: minor Milestone: 4.x
Component: JavaScript Version: 4.2
Keywords: Cc:

Description

The Javascript within the autocomplete widget doesn't satisfy the requirements of valid XHTML. Within plone/formwidget/autocomplete/widget.py, the js_template variable (line 96) for the rendered inline Javascript for the autocomlete widget should be wrapped with a CDATA section, eg:

    js_template = """\
    /* <![CDATA[ */
    ...javascript...
    /* ]]> */
    """

Because the script inside it contains special characters (specifically < and >, being part of the html tags to be generated), this part of the document fails to be valid XHTML.

Change History

comment:1 Changed 5 years ago by limi

  • Owner set to optilude
  • Component changed from Unknown to Javascript

I think this is Martin's product?

comment:2 Changed 5 years ago by optilude

Does that work in all browsers?

comment:3 Changed 5 years ago by kleist

"Properly enclosing script contents inside of CDATA sections can cause problems in downlevel browsers which do not understand XML. However, it is possible to combine JavaScript Comments with CDATA sections to allow for backward compatibility.":

 https://developer.mozilla.org/en/Properly_Using_CSS_and_JavaScript_in_XHTML_Documents#Using_CDATA_Instead_of_Comments

comment:4 Changed 3 years ago by kleist

  • Status changed from new to confirmed
  • Milestone changed from 3.3.x to 4.x
  • Version set to 4.2
  • Summary changed from plone.formwidge.autocomplete's Javascript should be wrapped in a CDATA section to plone.formwidget.autocomplete: Javascript should be wrapped in a CDATA section

comment:5 Changed 3 years ago by davidjb

  • Status changed from confirmed to closed
  • Resolution set to fixed

The code has since been rewritten to move the special characters out:  https://github.com/plone/plone.formwidget.autocomplete/commit/d6ae92564c23bf9a042a676f3ea6e3676e79bcd5 and since Plone has changed to HTML5 this CDATA isn't necessary any more within <script> tags.

Note: See TracTickets for help on using tickets.