From 5a01e6535d3339c1c8c0cbd1938f00ca269989c3 Mon Sep 17 00:00:00 2001
From: Dimitri Gritsajuk <gritsajuk.dimitri@gmail.com>
Date: Sun, 11 Nov 2018 21:04:11 +0100
Subject: [PATCH] [SafeScripting] disable autoclosing of <script /> tag (#198)

---
 configdoc/usage.xml                                 |  2 +-
 library/HTMLPurifier/HTMLModule/SafeScripting.php   |  2 +-
 tests/HTMLPurifier/HTMLModule/SafeScriptingTest.php | 10 +++++++++-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/configdoc/usage.xml b/configdoc/usage.xml
index c0d47081..beab30c2 100644
--- a/configdoc/usage.xml
+++ b/configdoc/usage.xml
@@ -410,7 +410,7 @@
  </directive>
  <directive id="Core.EnableIDNA">
   <file name="HTMLPurifier/AttrDef/URI/Host.php">
-   <line>105</line>
+   <line>109</line>
   </file>
  </directive>
  <directive id="Attr.DefaultTextDir">
diff --git a/library/HTMLPurifier/HTMLModule/SafeScripting.php b/library/HTMLPurifier/HTMLModule/SafeScripting.php
index 0330cd97..93d0966f 100644
--- a/library/HTMLPurifier/HTMLModule/SafeScripting.php
+++ b/library/HTMLPurifier/HTMLModule/SafeScripting.php
@@ -23,7 +23,7 @@ class HTMLPurifier_HTMLModule_SafeScripting extends HTMLPurifier_HTMLModule
         $script = $this->addElement(
             'script',
             'Inline',
-            'Empty',
+            'Optional:', // Not `Empty` to not allow to autoclose the <script /> tag @see https://www.w3.org/TR/html4/interact/scripts.html
             null,
             array(
                 // While technically not required by the spec, we're forcing
diff --git a/tests/HTMLPurifier/HTMLModule/SafeScriptingTest.php b/tests/HTMLPurifier/HTMLModule/SafeScriptingTest.php
index 20972975..17c0763a 100644
--- a/tests/HTMLPurifier/HTMLModule/SafeScriptingTest.php
+++ b/tests/HTMLPurifier/HTMLModule/SafeScriptingTest.php
@@ -20,7 +20,15 @@ class HTMLPurifier_HTMLModule_SafeScriptingTest extends HTMLPurifier_HTMLModuleH
     public function testGood()
     {
         $this->assertResult(
-            '<script type="text/javascript" src="http://localhost/foo.js" />'
+            '<script type="text/javascript" src="http://localhost/foo.js"></script>'
+        );
+    }
+
+    public function testGoodWithAutoclosedTag()
+    {
+        $this->assertResult(
+            '<script type="text/javascript" src="http://localhost/foo.js"/>',
+            '<script type="text/javascript" src="http://localhost/foo.js"></script>'
         );
     }