Beefy Boxes and Bandwidth Generously Provided by pair Networks
No such thing as a small change
 
PerlMonks  

Re^2: side effects "Enforce proper nesting of HTML"

by LanX (Saint)
on Jun 05, 2017 at 10:25 UTC ( [id://1192150]=note: print w/replies, xml ) Need Help??


in reply to Re: side effects "Enforce proper nesting of HTML"
in thread side effects "Enforce proper nesting of HTML"

Shouldn't illegal markup always be rejected?

Cheers Rolf
(addicted to the Perl Programming Language and ☆☆☆☆ :)
Je suis Charlie!

  • Comment on Re^2: side effects "Enforce proper nesting of HTML"

Replies are listed 'Best First'.
Re^3: side effects "Enforce proper nesting of HTML"
by tobyink (Canon) on Jun 05, 2017 at 10:56 UTC

    Be conservative in what you do, be liberal in what you accept from others.
    —Postel's law

      I should have clarified that my motivation was security not a purist ideology.

      Cheers Rolf
      (addicted to the Perl Programming Language and ☆☆☆☆ :)
      Je suis Charlie!

        Unapproved mark-up (both HTML tags and HTML attributes) are already always blocked. That takes care of the cross-site scripting security concern.

        An enhancement was implemented to go further and better protect site layout from (usually unintentional) inclusion of approved tags in a manner that can interfere with layout beyond the contents of the individual submission. This enhancement goes beyond noting that 'br' tags are approved for inclusion so it also blocks any 'br' tags that are not "properly nested". So you can, for example, include "<br>", "<br></br>", and "<br />" and not have them blocked.

        However, with the enhanced validation, including something like "</br>" or "</p>" without a matching, preceding opening tag, will lead to that tag being blocked. Without the enhancement, such constructs are included (which presents absolutely no problem that could be described as "security").

        During the trial period where the enhancement is optional to shake out unintended consequences, it was discovered that misplacing the "/" in "<p />" by using "</p>" was such a common mistake that many browsers had decided to interpret the latter as the former.

        That was really the only major problem discovered. It frankly should not be particularly difficult to fix that and then make the enhancement no longer optional. I'm even tempted to just make the enhancement no longer optional even without that tweak (except for the impact it would have on previously-posted nodes).

        I thought that I had already made the increased validation the default for new users and something that applied to anonymonk. At least the latter appears to not be true or was reverted (perhaps by a bug that allowed anonymonk to sometimes impact those settings).

        - tye        

Re^3: side effects "Enforce proper nesting of HTML"
by Lady_Aleena (Priest) on Jun 05, 2017 at 10:32 UTC

    I would support it. I would support removing deprecated HTML as well.

    No matter how hysterical I get, my problems are not time sensitive. So, relax, have a cookie, and a very nice day!
    Lady Aleena
      At the time PM was drafted, HTML was still evolving, so I'm not surprised.

      Anyway my question was just a question, ie seeking better understanding and not a call for action which needs "support".

      Not sure if my English is flawed here ...

      Cheers Rolf
      (addicted to the Perl Programming Language and ☆☆☆☆ :)
      Je suis Charlie!

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://1192150]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others admiring the Monastery: (4)
As of 2024-04-20 20:39 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found