From patchwork Fri Dec 15 06:03:28 2017
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: hgweb: stop using HTML comments in <script>
From: Anton Shestakov <av6@dwimlabs.net>
X-Patchwork-Id: 26295
Message-Id: <dc231e0cdccd7aa632b9.1513317808@neuro>
To: mercurial-devel@mercurial-scm.org
Date: Fri, 15 Dec 2017 14:03:28 +0800

# HG changeset patch
# User Anton Shestakov <av6@dwimlabs.net>
# Date 1513311358 -28800
#      Fri Dec 15 12:15:58 2017 +0800
# Node ID dc231e0cdccd7aa632b9787bcfbb216cb7bfb39b
# Parent  b24e015797a6d4654369636987efaf9c8000375e
hgweb: stop using HTML comments in <script>

Once upon a time, in 1995, there were browsers that didn't understand <script>
tags and they would simply show the code inside as text. This started a
tradition of wrapping everything inside <script> in <!-- HTML comments -->.
Nowadays, it's not only not needed, but can be considered harmful[1]:

- within XHTML documents, the source will actually be hidden from all browsers
  and rendered useless

- `--` is not allowed within HTML comments, so any decrement operations in
  script are invalid

[1]: http://www.javascripttoolbox.com/bestpractices/#comments

diff --git a/mercurial/templates/gitweb/graph.tmpl b/mercurial/templates/gitweb/graph.tmpl
--- a/mercurial/templates/gitweb/graph.tmpl
+++ b/mercurial/templates/gitweb/graph.tmpl
@@ -43,8 +43,6 @@ graph |
 </div>
 
 <script{if(nonce, ' nonce="{nonce}"')}>
-<!-- hide script content
-
 var data = {jsdata|json};
 var graph = new Graph();
 graph.scale({bg_height});
@@ -55,8 +53,6 @@ graph.vertex = function(x, y, radius, co
 }
 
 graph.render(data);
-
-// stop hiding script -->
 </script>
 
 <div class="extra_nav">
diff --git a/mercurial/templates/monoblue/graph.tmpl b/mercurial/templates/monoblue/graph.tmpl
--- a/mercurial/templates/monoblue/graph.tmpl
+++ b/mercurial/templates/monoblue/graph.tmpl
@@ -35,8 +35,6 @@
     </div>
 
     <script{if(nonce, ' nonce="{nonce}"')}>
-    <!-- hide script content
-
     document.getElementById('noscript').style.display = 'none';
 
     var data = {jsdata|json};
@@ -49,8 +47,6 @@
     }
 
     graph.render(data);
-
-    // stop hiding script -->
     </script>
 
     <div class="page-path">
diff --git a/mercurial/templates/paper/graph.tmpl b/mercurial/templates/paper/graph.tmpl
--- a/mercurial/templates/paper/graph.tmpl
+++ b/mercurial/templates/paper/graph.tmpl
@@ -56,8 +56,6 @@
 </div>
 
 <script type="text/javascript"{if(nonce, ' nonce="{nonce}"')}>
-<!-- hide script content
-
 var data = {jsdata|json};
 var graph = new Graph();
 graph.scale({bg_height});
@@ -68,8 +66,6 @@ graph.vertex = function(x, y, radius, co
 }
 
 graph.render(data);
-
-// stop hiding script -->
 </script>
 
 <div class="navigate">
diff --git a/mercurial/templates/spartan/graph.tmpl b/mercurial/templates/spartan/graph.tmpl
--- a/mercurial/templates/spartan/graph.tmpl
+++ b/mercurial/templates/spartan/graph.tmpl
@@ -37,8 +37,6 @@ navigate: <small class="navigate">{chang
 </div>
 
 <script type="text/javascript"{if(nonce, ' nonce="{nonce}"')}>
-<!-- hide script content
-
 var data = {jsdata|json};
 var graph = new Graph();
 graph.scale({bg_height});
@@ -49,8 +47,6 @@ graph.vertex = function(x, y, radius, co
 }
 
 graph.render(data);
-
-// stop hiding script -->
 </script>
 
 <form action="{url|urlescape}log">
diff --git a/tests/test-hgweb-commands.t b/tests/test-hgweb-commands.t
--- a/tests/test-hgweb-commands.t
+++ b/tests/test-hgweb-commands.t
@@ -1814,8 +1814,6 @@ Overviews
   </div>
   
   <script>
-  <!-- hide script content
-  
   var data = [{"edges": [[0, 0, 1, 3, "FF0000"]], "node": "cad8025a2e87", "vertex": [0, 1]}, {"edges": [[0, 0, 1, 3, ""]], "node": "1d22e65f027e", "vertex": [0, 1]}, {"edges": [[0, 0, 1, 3, ""]], "node": "a4f92ed23982", "vertex": [0, 1]}, {"edges": [], "node": "2ef0ac749a14", "vertex": [0, 1]}];
   var graph = new Graph();
   graph.scale(39);
@@ -1826,8 +1824,6 @@ Overviews
   }
   
   graph.render(data);
-  
-  // stop hiding script -->
   </script>
   
   <div class="extra_nav">
diff --git a/tests/test-hgweb-empty.t b/tests/test-hgweb-empty.t
--- a/tests/test-hgweb-empty.t
+++ b/tests/test-hgweb-empty.t
@@ -300,8 +300,6 @@ Some tests for hgweb in an empty reposit
   </div>
   
   <script type="text/javascript">
-  <!-- hide script content
-  
   var data = [];
   var graph = new Graph();
   graph.scale(39);
@@ -312,8 +310,6 @@ Some tests for hgweb in an empty reposit
   }
   
   graph.render(data);
-  
-  // stop hiding script -->
   </script>
   
   <div class="navigate">