X-Git-Url: https://git.heureux-cyclage.org/?a=blobdiff_plain;f=includes%2FHtml.php;h=aac492c921cc2a4525d5cab7ddf124eac0ca78d3;hb=a479750da672066b4189b115d1141a23d8c5cae3;hp=32375c1f57cb0ff648c32883f050fbf6f559876e;hpb=fd08137ebf8b34cb1a9711c34d6c4d0357aea5b7;p=lhc%2Fweb%2Fwiklou.git

diff --git a/includes/Html.php b/includes/Html.php
index 32375c1f57..aac492c921 100644
--- a/includes/Html.php
+++ b/includes/Html.php
@@ -552,10 +552,13 @@ class Html {
 	}
 
 	/**
-	 * Output a "<script>" tag with the given contents.
+	 * Output an HTML script tag with the given contents.
 	 *
-	 * @todo do some useful escaping as well, like if $contents contains
-	 * literal "</script>" or (for XML) literal "]]>".
+	 * It is unsupported for the contents to contain the sequence `<script` or `</script`
+	 * (case-insensitive). This ensures the script can be terminated easily and consistently.
+	 * It is the responsibility of the caller to avoid such character sequence by escaping
+	 * or avoiding it. If found at run-time, the contents are replaced with a comment, and
+	 * a warning is logged server-side.
 	 *
 	 * @param string $contents JavaScript
 	 * @param string|null $nonce Nonce for CSP header, from OutputPage::getCSPNonce()
@@ -571,8 +574,9 @@ class Html {
 			}
 		}
 
-		if ( preg_match( '/[<&]/', $contents ) ) {
-			$contents = "/*<![CDATA[*/$contents/*]]>*/";
+		if ( preg_match( '/<\/?script/i', $contents ) ) {
+			wfLogWarning( __METHOD__ . ': Illegal character sequence found in inline script.' );
+			$contents = '/* ERROR: Invalid script */';
 		}
 
 		return self::rawElement( 'script', $attrs, $contents );
@@ -704,7 +708,7 @@ class Html {
 	 * @return string of HTML representing a box.
 	 */
 	private static function messageBox( $html, $className, $heading = '' ) {
-		if ( $heading ) {
+		if ( $heading !== '' ) {
 			$html = self::element( 'h2', [], $heading ) . $html;
 		}
 		return self::rawElement( 'div', [ 'class' => $className ], $html );