3

I recently participated in a CTF and solution of that CTF is based on this weird behavior of browser.

In First case when I am including script tag inside an HTML comment and without closing that comment then the browser(Firefox) assumes whole content after that as comment including body part. And no alert is popped.

Code:

<script>
alert(1);
<!--<script
alert(2);
</script>
<body>Hello</body>

Browser:

enter image description here

In Second all code is same except I removed script tag from comment now browser ending comment at that position and all other code executed smoothly. Both alert popped 1,2

Code:

<script>
alert(1);
<!--
alert(2);
</script>
<body>Hello</body>

Browser:

enter image description here

So I have two questions.

  1. In first case when browser is assuming code in next lines as comment why even alert(1) is not popped?
  2. Second why browser having different boundaries of HTML comment based on script Tag?

Please answer them or point to any resources. And feel free to modify question, I am new to this field and might have added some rubbish.

Improve this question

2 Answers 2

Reset to default
1

I think it is something to do with browser's HTML validating technique. Browser is trying to close missing tags.

Do browsers automatically insert missing HTML tags?

Like in first case adding missing closing tag of HTML comment, and converts whole document as comment. But why it is doing differently in first and second case. I think that's why it is said that complexity creates problems. Browser is trying to be too smart and tripping over own feet. No other reason.

Improve this answer
1

An interesting situation indeed. First of all, it must be noted that we cannot nest <script> tags. In the first case

alert(1);
<!--<script
alert(2);
</script>
<body>Hello</body>

the <script has > missing. Even with that it won't work. However, if we replace it with </script>, alert(1) runs. The second case is the same as this with alert(2) included within the <script> tags.

Improve this answer
1
  • Why comment is ending at the same place in second case, while in first case it covering whole document as comment.
    – Monu
    Dec 29, 2020 at 13:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .