Repository navigation
"Any other end tag" #6788
Description
Activity
I posted this response to your comments in the html5lib repo, but I'd meant to do it here:
I believe your reading is correct - and that it was pointed out that this created a dangerous loophole for exploiting sanitizer round tripping. I'm not certain but I think maybe due to the nature of the problem vendors and some libraries may have addressed it before the spec was actually updated to reflect the necessary change.
The open PR addresses it by making
</p>pop open elements until an HTML element / HTML integration point element is the current node.
https://html.spec.whatwg.org/multipage/parsing.html#scriptForeignEndTag
I think there might be a spec bug here. html5lib-tests added tree-building tests of the form
<math></p><foo>. That test in particular agrees with how Safari, Firefox, and Chrome parse that bit of HTML. The Gumbo and html5ever parsers disagree. My reading of the spec agrees with Gumbo and html5ever.Essentially, should the
</p><foo>mathelement to be closed and HTMLpandfooelements to be inserted as children of thebodyelement; orpelement and a MathMLfooelement as children of themathelement?If 1 (what the browsers do), where does (or should) the specification specify that?