An unclosed, unescaped <script> tag in markdown should be rendered as text to match GH/GL behavior

[wyattoday]

• Gitea version (or commit ref): Current master: f29458b
• Git version: 2.13.3
• Operating system: Ubuntu Linux 16.04
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes: https://try.gitea.io/wyattoday/simple-respository/src/new-feature-branch/BrokenRendering.md
  • No
  • Not relevant
• Log gist:

Description

An unclosed, unescaped <script> tag in markdown breaks all subsequent markdown rendering in gitea. The same problem does not effect more benign tags like <strong>.

Gitea should render the <script> tag "as is" (that is, the text, but not emitting the <script> HTML). That would match the behavior in github.

Here's the raw Markdown file: https://try.gitea.io/wyattoday/simple-respository/raw/new-feature-branch/BrokenRendering.md

Here's the broken rendering: https://try.gitea.io/wyattoday/simple-respository/src/new-feature-branch/BrokenRendering.md

Screenshots

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

[wyattoday]

This issue is still very much alive: https://try.gitea.io/wyattoday/Test1234/src/branch/master/README.md

[lunny]

Should be closed, see https://try.gitea.io/wyattoday/Test1234/src/branch/master/README.md

[wyattoday]

Still very broken.

See : https://try.gitea.io/wyattoday/Test1234/raw/branch/master/README.md

Notice how the lines after the <script> tag are not written out.

The markdown renderer should remove malicious tags (expecially <script>) to match how other systems like Gitlab / Github render markdown.

[zeripath]

How would you suggest we do this?

How should they be rendered? Please link to an actual example of how you expect it be rendered and explain your rules for how we are supposed to determine what was "supposed to inside" the unclosed tag that we need to sanitize away. Including what you do when the tag is closed.

[wyattoday]

Script tags should be stripped completely. Or render them as text.

Either way, the current markdown behavior of breaking after a tag it doesn't like isn't a good way to handle things.

[zeripath]

The script tag is stripped along with its contents. Script is a block level element so an unclosed script block contains everything after it.