fcf433a736a8670c9da0e2af3ac54db24b0aaa3b
braney
Mon Aug 24 14:47:47 2026 -0700
htmlSanitize: rename the ids that come in with the HTML, refs #38126
The description HTML is printed inside a page of ours, and it is our own
JavaScript that looks ids up. A page that carries an id we already use puts
two elements of that name in one document, and getElementById returns whichever
comes first. Two ids in the public hub pages collide with ours today, one of
them "content". An id also becomes a property of that name on window, which
reaches the guards we write as "typeof X !== 'undefined' && X".
Every id, and every name on an anchor, now gets the prefix descPage- . The
hyphen means the window property it makes can never be spelled as a JavaScript
name, so it cannot stand in for one of our globals either. A link to a name on
the same page, href="#x", is rewritten with the same prefix and keeps working.
A link that names another page is left alone: it leaves our page for the hub's
own file, where the names are unchanged.
Measured over the 5390 description pages of the public hubs: 1643 ids and
anchor names renamed, no id left without the prefix, and the number of same
page links with nothing to point at is 22 before and 22 after, the same ones.
No page loses reader-visible text and the hubCheck warnings are unchanged at
118 pages, since a reader sees nothing of this.
diff --git src/lib/tests/expected/htmlSanitizeTest src/lib/tests/expected/htmlSanitizeTest
index 6f778d66bfa..9cdddbdf030 100644
--- src/lib/tests/expected/htmlSanitizeTest
+++ src/lib/tests/expected/htmlSanitizeTest
@@ -1,72 +1,75 @@
in : THead
Text
out: Head
Text
in : before
after
out: before
after
(removed the script element and everything inside it)
(removed the style element and everything inside it)
in : before