Safari is more forgiving locally than remotely with malformed HTML. Why?_问答_开发者

Safari is more forgiving locally than remotely with malformed HTML. Why?

开发者 https://www.devze.com 2023-04-10 14:02 出处：网络

I ran into a curious issu开发者_StackOverflow社区e today. We have a web page that hides the body via CSS and then there\'s a bit of JavaScript that sets the body to display: block to show it. (This is

相关专题：security

I ran into a curious issu开发者_StackOverflow社区e today. We have a web page that hides the body via CSS and then there's a bit of JavaScript that sets the body to display: block to show it. (This is part of some iFrame busting logic we are required to add).

We were having issues on one page but only in Safari. In taking a look at things, I found that the culprit was that an include file was being called that contained its own body tag so we were ending up with malformed HTML with a body tag nested within the pages existing body tag.

Since the JS was looking for the first body tag the content we actually wanted to show was never shown, since it was wrapped with the second body tag.

I assume Firefox was just forgiving of the HTML and ignored the second body tag. Safari didn't do this when we looked at the page on the server.

However, if I grab the file and run it locally, Safari does tell me:

Extra <body> encountered. Migrating attributes back to the original <body> element and ignoring the tag.

I'm curious as to why Safari might have adopted this 'policy' of ignoring bad HTML locally but not from a server. If it matters, it is an https site we're hitting. Perhaps Safari is being wise and trying to avoid any potential security issues with allowing bad HTML?