doc/bugs/escaped_style_tag_becomes_elyts.mdwn


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

When IkiWiki uses discount to implement [[plugins/mdwn]] rendering,
there is a workaround for <https://rt.cpan.org/Ticket/Display.html?id=74016>:

<pre><code>$t=~s/&lt;style/&lt;elyts/ig;
my $r=Text::Markdown::Discount::markdown($t);
$r=~s/&lt;elyts/&lt;style/ig;
</code></pre>

However, this workaround also applies to indented text or text in backticks:
if you write <code>there is a bug involving the \`&lt;style&gt;\` tag</code>,
or use indentation like

<pre><code>you can use this markup:

    &lt;style type="text/css"&gt;...&lt;/style&gt;
</code></pre>

then that gets turned into `<elyts` in the source before passing through
`markdown`, comes out as `&lt;elyts` in the output HTML, and is rendered
as `<elyts` by the browser. This makes it quite difficult to talk about
HTML stylesheet markup on an IkiWiki instance (I had to use raw HTML in
this bug report's source to avoid the bug).

I think the side-effect of the workaround is more damaging than the actual bug
being worked around: I've never wanted to write inline style tags in the body of
a Markdown page (which isn't even valid HTML) but I have certainly wanted to
discuss style markup several times. The first couple of times I saw this happen,
I thought it was some sort of misguided anti-cross-site-scripting filter...

--[[smcv]]

> [[Fixed|done]] by passing the `MKD_NOSTYLE` flag to Discount instead.
> Unfortunately this isn't bound by [[!cpan Text::Markdown::Discount]] yet,
> so for now I'm hard-coding its numeric value. --[[smcv]]