I recently participated in a CTF and solution of that CTF is based on this weird behavior of browser.
In First case when I am including script tag inside an HTML comment and without closing that comment then the browser(Firefox) assumes whole content after that as comment including body part. And no alert is popped.
Code:
<script>
alert(1);
<!--<script
alert(2);
</script>
<body>Hello</body>
Browser:
In Second all code is same except I removed script tag from comment now browser ending comment at that position and all other code executed smoothly. Both alert popped 1,2
Code:
<script>
alert(1);
<!--
alert(2);
</script>
<body>Hello</body>
Browser:
So I have two questions.
- In first case when browser is assuming code in next lines as comment why even alert(1) is not popped?
- Second why browser having different boundaries of HTML comment based on script Tag?
Please answer them or point to any resources. And feel free to modify question, I am new to this field and might have added some rubbish.