{"version":"2.1.234","anchor":"script-detection-in-published-pages-handles-html-tokenizer-e","canonical_anchor":"script-detection-in-published-pages-handles-html-tokenizer-e","heading":"Script detection in published pages handles HTML tokenizer edge cases","tier":"internal","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/script-detection-in-published-pages-handles-html-tokenizer-e","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Script detection in published pages handles HTML tokenizer edge cases\n\nScript-tag scanning in published pages was reworked so hand-crafted markup can't slip past.\n\n**What**\n\nThe scanners that look for script tags in artifact pages, both in-page and in the CLI, were reworked as a matching pair so hand-crafted markup can no longer slip past them.\n\n**Details**\n\n- A comment-open followed by a script-open, which would leave the HTML tokenizer in an escaped state, is now refused outright.\n- Tag-end scanning walks attributes, so a `>` inside a quoted attribute value no longer looks like the end of the tag.\n- Whitespace skipping uses only the five ASCII whitespace bytes HTML defines, instead of JavaScript's broader `String.trim()`.\n\n**Evidence**\n\n`KEEP-IN-SYNC: goCp isFrameAssetInjection`\n\n- Area: Artifacts\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 1\/5"}