Summary
PerlOnJava produces a different defanged comment for an unterminated script start tag: it retains the source trailing newline inside the generated comment, whereas system Perl emits the closing comment immediately after the tag content.
CPAN impact
HTML::Defang 1.09 failed test 25, No closing script tags, in t/02_xss.t during CPAN tester run 20260827-171032-2227. For the input <SCRIPT SRC=http://ha.ckers.org/xss.js? followed by a newline, PerlOnJava produces a comment whose closing delimiter is on the next line. System Perl passes the test.
The output remains defanged, but it is incompatible with the established parser behavior.
Acceptance criteria
- Add a focused system-Perl-validated regression for the unterminated script-tag input.
- Match system Perl output on JVM and interpreter backends.
- HTML::Defang 1.09 t/02_xss.t passes on both backends.
Summary
PerlOnJava produces a different defanged comment for an unterminated script start tag: it retains the source trailing newline inside the generated comment, whereas system Perl emits the closing comment immediately after the tag content.
CPAN impact
HTML::Defang 1.09 failed test 25, No closing script tags, in t/02_xss.t during CPAN tester run 20260827-171032-2227. For the input <SCRIPT SRC=http://ha.ckers.org/xss.js? followed by a newline, PerlOnJava produces a comment whose closing delimiter is on the next line. System Perl passes the test.
The output remains defanged, but it is incompatible with the established parser behavior.
Acceptance criteria