Why splitting script closing tag in a string?

Question

I am working on an asp.net project and on part of it, I needed to print a part of the page which contains an image using javascript. After some digging, I found a code and it works fine.

<script>


function VoucherSourcetoPrint(source) {
    return "<html><head><script>function step1(){\n" +
            "setTimeout('step2()', 10);}\n" +
            "function step2(){window.print();window.close()}" +
            "\n</scri" + "pt></head><body onload='step1()'>\n" + <%-- lokk this line--%>
            "<img src='" + source + "' style='width: 300px; height: 150px; margine:none;' /></body></html>";
}

function VoucherPrint(source) {    
    Pagelink = "about:blank";
    var pwa = window.open(Pagelink, "_new");
    pwa.document.open();
    pwa.document.write(VoucherSourcetoPrint(source));
    pwa.document.close();
}


</script>

As you can see on the first function it is returning a string and in that there is a script closing tag, which is written as </scri" + "pt>, first I thought it was a mistake and tried removing the extra quotes and plus sign and then the string showing error.

I am confused, why is it have to be like </scri" + "pt>??

To avoid an HTML parser from reading this JavaScript code and interpreting it as HTML. — VLAZ
– VLAZ, Commented Mar 27, 2019 at 11:49
Because the HTML parser doesn't search for a starting script tag from within a script. — Teemu
– Teemu, Commented Mar 27, 2019 at 11:52
You only need to stop the closing tag from closing the <script> tag prematurely. — VLAZ
– VLAZ, Commented Mar 27, 2019 at 11:52

Quentin · Accepted Answer · 2019-03-27 11:58:50Z

2

Because the HTML parser will find the sequence of characters "</script>" and end the script element. It will then pass invalid JavaScript to the JavaScript parser.

Here is a simplified example:

<script>console.log("</script>");</script>
▲       ▲           ▲▲        ▲  ▲
1       2           34        5  6

Script element start tag.
Begining of JavaScript (console.log(" - not a compilable script).
End of JavaScript
Script element end tag
Text to show as plain text in the HTML document (");)
Script end for with no matching open tag. Discarded by HTML parser as an error.

A more elegant approach is to just escape the /:

<script>console.log("<\/script>");</script>

edited Mar 27, 2019 at 11:58

answered Mar 27, 2019 at 11:49

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Why splitting script closing tag in a string?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related