From aca9d725ed00fd73f198afe234959b749c8b41d8 Mon Sep 17 00:00:00 2001
From: "Edward Z. Yang" <edwardzyang@thewritingpot.com>
Date: Thu, 15 May 2008 04:40:13 +0000
Subject: [PATCH] [2.1.4] [MFH] Fix bug with trusted script handling in libxml
 versions later than 2.6.28 from r1553.

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/branches/php4@1714 48356398-32a2-884e-a903-53898d9a118a
---
 NEWS                                  |  1 +
 library/HTMLPurifier/Lexer/DOMLex.php | 21 +++++++++++++++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index 57a3511e..8d89d0da 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,7 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
 - CSS Number algorithm improved
 - Autoclose now operates iteratively, i.e. <span><span><div> now has
   both span tags closed.
+- Fix bug with trusted script handling in libxml versions later than 2.6.28.
 
 2.1.3, released 2007-11-05
 ! tests/multitest.php allows you to test multiple versions by running
diff --git a/library/HTMLPurifier/Lexer/DOMLex.php b/library/HTMLPurifier/Lexer/DOMLex.php
index 56bd4a48..9aef335b 100644
--- a/library/HTMLPurifier/Lexer/DOMLex.php
+++ b/library/HTMLPurifier/Lexer/DOMLex.php
@@ -90,10 +90,27 @@ class HTMLPurifier_Lexer_DOMLex extends HTMLPurifier_Lexer
             $tokens[] = $this->factory->createText($node->data);
             return;
         } elseif ($node->nodeType === XML_CDATA_SECTION_NODE) {
-            // undo DOM's special treatment of <script> tags
-            $tokens[] = $this->factory->createText($this->parseData($node->data));
+            // undo libxml's special treatment of <script> and <style> tags
+            $last = end($tokens);
+            $data = $node->data;
+            // (note $node->tagname is already normalized)
+            if ($last instanceof HTMLPurifier_Token_Start && $last->name == 'script') {
+                $new_data = trim($data);
+                if (substr($new_data, 0, 4) === '<!--') {
+                    $data = substr($new_data, 4);
+                    if (substr($data, -3) === '-->') {
+                        $data = substr($data, 0, -3);
+                    } else {
+                        // Highly suspicious! Not sure what to do...
+                    }
+                }
+            }
+            $tokens[] = $this->factory->createText($this->parseData($data));
             return;
         } elseif ($node->nodeType === XML_COMMENT_NODE) {
+            // this is code is only invoked for comments in script/style in versions
+            // of libxml pre-2.6.28 (regular comments, of course, are still
+            // handled regularly)
             $tokens[] = $this->factory->createComment($node->data);
             return;
         } elseif (