Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121187
Date: Fri, 29 Sep 2023 14:38:59 -0700 (PDT)
Reply-To: Dennis Snell <dennis.snell@automattic.com>
To: Niels Dossche <dossche.niels@gmail.com>
Cc: <internals@lists.php.net>
Message-ID: <23E1FB16-8ED9-4EF5-B5E2-D9136AF638D2@automattic.com>
In-Reply-To: <574563c3-6970-43ce-ad4d-860975a8602f@gmail.com>
References: <0c2d7e79-2c74-4263-81ec-ac8832ca50bb@gmail.com>
	<5F88257F-58CB-45AA-B2CC-ABEA19AD7474@automattic.com>
	<574563c3-6970-43ce-ad4d-860975a8602f@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="=_E92E9851-16D0-490C-AE6C-A148ADF0FD8E"
Subject: Re: [PHP-DEV] Re: [RFC] [Discussion] DOM HTML5 parsing and serialization support
From: internals@lists.php.net ("Dennis Snell via internals")

--=_E92E9851-16D0-490C-AE6C-A148ADF0FD8E
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable

> Just chiming in here to say that while we don't offer a createFragment() =
in this proposal, it's possible to parse fragments by passing the LIBXML_HT=
ML_NOIMPLIED option. Alternatively, in the future I plan to offer innerHTML=
 which you could use then in conjunction with createDocumentFragment().


It=E2=80=99s not my understanding that this is right here, because fragment=
 parsing implies more than having or not having the HTML and BODY elements =
implicitly.


>=C2=A0Sets HTML_PARSE_NOIMPLIED flag, which turns off the automatic adding=
 of implied html/body... elements.


The HTML5 spec defines fragment parsing as starting within a context node w=
hich exists within a broader document. For example, many people will parse =
a string of HTML that should form the contents of an LI element. They are g=
rabbing that HTML from a database somewhere, from user input. If that HTML =
contains =E2=80=9C</li>=E2=80=9D then our behavior diverges. In a fragment =
parser it would close out the list we started with but in full document par=
sing mode the end tag would be ignored, a parse error. If the goal is to en=
sure that user input doesn=E2=80=99t break out and change the page, then it=
=E2=80=99s important to use fragment parsing and grab the inner contents of=
 that LI context node.


This can be valuable to have as a tool to guard against injection attacks o=
r against accidentally breaking the page someone is building, because the f=
ragment parser is aware of its environment. It becomes even more important =
when parsing within RCDATA or RAWTEXT sections. For example, if wanting to =
parse and analyze or manipulate a web page=E2=80=99s title then the parser =
should treat everything as plaintext until it reaches the end or encounters=
 a closing TITLE tag. If trying to do this with `createFromString()` then i=
t=E2=80=99s up to the caller to remember to prepend and then remove the env=
ironment, `createFromString( =E2=80=98<title>=E2=80=99 . $page_title . =
=E2=80=98</title>=E2=80=99 )`. The fragment parser would be similar in prac=
tice, but more explicit and hard to misunderstand in these circumstances.


This is complicated stuff. I understand that the spec provides for a wide v=
ariety of use-cases and needs, and that it=E2=80=99s hard to pin down exact=
ly what a spec-compliant parser is supposed to do in all situations (it dep=
ends), so I=E2=80=99m only wanting to share from the perspective of people =
doing a lot of small HTML manipulation. There=E2=80=99s not much code out t=
here using the fragment parser, but I can=E2=80=99t help but think that par=
t of the reason is because it=E2=80=99s not exposed where it ought to be.


Have a great weekend!
Dennis Snell
>=20

--=_E92E9851-16D0-490C-AE6C-A148ADF0FD8E--