You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
<style type>/<script type> and MIME type parameters #3022
Firefox ignores them, Chrome and Safari require them to not be present. I vastly prefer Chrome and Safari behavior as that allows for just string matching here.
Live DOM Viewer test: <script type=text/javascript;x>w(1)</script>.
I'm pretty sure for script at least the spec requires them not to be present or else it's treated as a data block. Definitely will be good to add tests.
It doesn't really. It says "MIME type" and "valid MIME type", both of which include parameters as far as I can tell. So there's all sorts of problems here for sure.
If the script block's type string is an ASCII case-insensitive match for any JavaScript MIME type, the script's type is "classic".
and then in the definition of JavaScript MIME type,
When examining types to determine if they represent supported languages, user agents must not ignore MIME parameters. Types are to be compared including all parameters.
We could do some cleanup to make things clearer, but I think at least from the processing model side, we're covered.
Activity
annevk commentedon Sep 7, 2017
(Note that valid parameters, such as
text/javascript;charset=utf-8, don't make any difference.)annevk commentedon Sep 7, 2017
This also applies to
<style type>.[-]<script type> and MIME type parameters[/-][+]<style type>/<script type> and MIME type parameters[/+]annevk commentedon Sep 7, 2017
(Somewhat related to ongoing research over at whatwg/mimesniff#30.)
domenic commentedon Sep 7, 2017
I'm pretty sure for script at least the spec requires them not to be present or else it's treated as a data block. Definitely will be good to add tests.
annevk commentedon Sep 7, 2017
It doesn't really. It says "MIME type" and "valid MIME type", both of which include parameters as far as I can tell. So there's all sorts of problems here for sure.
annevk commentedon Sep 7, 2017
Ah, but the processing model does call for an ASCII case-insensitive match of a JavaScript MIME type, so we got that going for us.
domenic commentedon Sep 7, 2017
and then in the definition of JavaScript MIME type,
We could do some cleanup to make things clearer, but I think at least from the processing model side, we're covered.
annevk commentedon Sep 7, 2017
Yeah, and for
<style>we're not covered due to being overly generic which you filed an issue on already.annevk commentedon Sep 7, 2017
Firefox bug for
<script type>: https://bugzilla.mozilla.org/show_bug.cgi?id=1397822.domenic commentedon Sep 7, 2017
I can work on the spec side of this for script and also style de-genericization today.
Improve <style> and <script> processing and conformance
Improve <style> and <script> processing and conformance
annevk commentedon Sep 14, 2017
Updated the Firefox bug to also cover
<style type>.Improve <style> and <script> processing and conformance
Improve <style> and <script> processing and conformance