From 1719a318ad2004e33dc77f952e6f2263815cb6c7 Mon Sep 17 00:00:00 2001
From: Rich Harris <richard.a.harris@gmail.com>
Date: Mon, 8 Jan 2018 21:56:30 -0500
Subject: [PATCH 1/5] failing test for #1082

---
 .../runtime/samples/script-style-non-top-level/_config.js | 8 ++++++++
 test/runtime/samples/script-style-non-top-level/main.html | 4 ++++
 2 files changed, 12 insertions(+)
 create mode 100644 test/runtime/samples/script-style-non-top-level/_config.js
 create mode 100644 test/runtime/samples/script-style-non-top-level/main.html

diff --git a/test/runtime/samples/script-style-non-top-level/_config.js b/test/runtime/samples/script-style-non-top-level/_config.js
new file mode 100644
index 0000000000..1aade72239
--- /dev/null
+++ b/test/runtime/samples/script-style-non-top-level/_config.js
@@ -0,0 +1,8 @@
+export default {
+	html: `
+		<div>
+			<style>div { color: red; }</style>
+			<script>alert('<>');</script>
+		</div>
+	`
+};
\ No newline at end of file
diff --git a/test/runtime/samples/script-style-non-top-level/main.html b/test/runtime/samples/script-style-non-top-level/main.html
new file mode 100644
index 0000000000..94cf72e4bd
--- /dev/null
+++ b/test/runtime/samples/script-style-non-top-level/main.html
@@ -0,0 +1,4 @@
+<div>
+	<style>div { color: red; }</style>
+	<script>alert('<>');</script>
+</div>
\ No newline at end of file

From 5d0f44ef4153737f6d8e81bb9996e9c0a747ffa6 Mon Sep 17 00:00:00 2001
From: Conduitry <git@fur.army>
Date: Thu, 8 Feb 2018 14:14:21 -0500
Subject: [PATCH 2/5] rework handling of non-root <script> and <style>

---
 src/generators/nodes/Element.ts                | 14 +++++++-------
 .../server-side-rendering/visitors/Element.ts  |  2 --
 .../server-side-rendering/visitors/Text.ts     | 11 ++++++++++-
 src/parse/state/tag.ts                         | 18 +++++++++++++++---
 4 files changed, 32 insertions(+), 13 deletions(-)

diff --git a/src/generators/nodes/Element.ts b/src/generators/nodes/Element.ts
index 48852c27ea..b1bd650bf7 100644
--- a/src/generators/nodes/Element.ts
+++ b/src/generators/nodes/Element.ts
@@ -232,7 +232,7 @@ export default class Element extends Node {
 				);
 			} else {
 				block.builders.create.addLine(
-					`${name}.innerHTML = ${stringify(this.children.map(toHTML).join(''))};`
+					`${name}.innerHTML = ${stringify(this.children.map(node => toHTML(node, false)).join(''))};`
 				);
 			}
 		} else {
@@ -414,8 +414,10 @@ export default class Element extends Node {
 			);
 		}
 
-		function toHTML(node: Element | Text) {
-			if (node.type === 'Text') return escapeHTML(node.data);
+		function toHTML(node: Element | Text, dontEscapeText: Boolean) {
+			if (node.type === 'Text') {
+				return dontEscapeText ? node.data : escapeHTML(node.data);
+			}
 
 			let open = `<${node.name}`;
 
@@ -433,11 +435,9 @@ export default class Element extends Node {
 
 			if (isVoidElementName(node.name)) return open + '>';
 
-			if (node.name === 'script' || node.name === 'style') {
-				return `${open}>${node.data}</${node.name}>`;
-			}
+			const shouldNotEscapeText = node.name === 'script' || node.name === 'style';
 
-			return `${open}>${node.children.map(toHTML).join('')}</${node.name}>`;
+			return `${open}>${node.children.map(node => toHTML(node, shouldNotEscapeText)).join('')}</${node.name}>`;
 		}
 	}
 
diff --git a/src/generators/server-side-rendering/visitors/Element.ts b/src/generators/server-side-rendering/visitors/Element.ts
index 486f0f01a3..21ec923e3d 100644
--- a/src/generators/server-side-rendering/visitors/Element.ts
+++ b/src/generators/server-side-rendering/visitors/Element.ts
@@ -68,8 +68,6 @@ export default function visitElement(
 
 	if (node.name === 'textarea' && textareaContents !== undefined) {
 		generator.append(textareaContents);
-	} else if (node.name === 'script' || node.name === 'style') {
-		generator.append(escape(node.data));
 	} else {
 		node.children.forEach((child: Node) => {
 			visit(generator, block, child);
diff --git a/src/generators/server-side-rendering/visitors/Text.ts b/src/generators/server-side-rendering/visitors/Text.ts
index 44b1665b2b..4d305f73da 100644
--- a/src/generators/server-side-rendering/visitors/Text.ts
+++ b/src/generators/server-side-rendering/visitors/Text.ts
@@ -8,5 +8,14 @@ export default function visitText(
 	block: Block,
 	node: Node
 ) {
-	generator.append(escapeHTML(escape(node.data).replace(/(\${|`|\\)/g, '\\$1')));
+	let text = escape(node.data).replace(/(\${|`|\\)/g, '\\$1');
+	if (
+		!node.parent ||
+		node.parent.type !== 'Element' ||
+		(node.parent.name !== 'script' && node.parent.name !== 'style')
+	) {
+		// unless this Text node is inside a <script> or <style> element, escape &,<,>
+		text = escapeHTML(text);
+	}
+	generator.append(text);
 }
diff --git a/src/parse/state/tag.ts b/src/parse/state/tag.ts
index a659dc6d3d..8b701cae1d 100644
--- a/src/parse/state/tag.ts
+++ b/src/parse/state/tag.ts
@@ -224,10 +224,22 @@ export default function tag(parser: Parser) {
 		);
 		parser.read(/<\/textarea>/);
 		element.end = parser.index;
-	} else if (name === 'script' || name === 'style') {
+	} else if (name === 'script') {
 		// special case
-		element.data = parser.readUntil(new RegExp(`</${name}>`));
-		parser.eat(`</${name}>`, true);
+		const start = parser.index;
+		const data = parser.readUntil(/<\/script>/);
+		const end = parser.index;
+		element.children.push({ start, end, type: 'Text', data });
+		parser.eat('</script>', true);
+		element.end = parser.index;
+	} else if (name === 'style') {
+		// special case
+		element.children = readSequence(
+			parser,
+			() =>
+				parser.template.slice(parser.index, parser.index + 8) === '</style>'
+		);
+		parser.read(/<\/style>/);
 		element.end = parser.index;
 	} else {
 		parser.stack.push(element);

From cf3705dc11f4cddf6104236b9dd0c9d02d06f4e9 Mon Sep 17 00:00:00 2001
From: Conduitry <git@fur.army>
Date: Thu, 8 Feb 2018 14:18:39 -0500
Subject: [PATCH 3/5] add test

---
 .../non-root-style-interpolation/_config.js   | 28 +++++++++++++++++++
 .../non-root-style-interpolation/main.html    | 20 +++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 test/runtime/samples/non-root-style-interpolation/_config.js
 create mode 100644 test/runtime/samples/non-root-style-interpolation/main.html

diff --git a/test/runtime/samples/non-root-style-interpolation/_config.js b/test/runtime/samples/non-root-style-interpolation/_config.js
new file mode 100644
index 0000000000..a5d963e897
--- /dev/null
+++ b/test/runtime/samples/non-root-style-interpolation/_config.js
@@ -0,0 +1,28 @@
+export default {
+	data: {
+		color: 'red',
+	},
+
+	html: `
+		<div>
+			<style>
+			/* something with < and > */
+				div {
+					color: blue;
+				}
+			</style>
+			foo
+		</div>
+
+		<div>
+			<div>
+				<style>
+					div > div {
+						color: red;
+					}
+				</style>
+				foo
+			</div>
+		</div>
+	`,
+};
diff --git a/test/runtime/samples/non-root-style-interpolation/main.html b/test/runtime/samples/non-root-style-interpolation/main.html
new file mode 100644
index 0000000000..107c5e89ae
--- /dev/null
+++ b/test/runtime/samples/non-root-style-interpolation/main.html
@@ -0,0 +1,20 @@
+<div>
+	<style>
+	/* something with < and > */
+		div {
+			color: blue;
+		}
+	</style>
+	foo
+</div>
+
+<div>
+	<div>
+		<style>
+			div > div {
+				color: {{color}};
+			}
+		</style>
+		foo
+	</div>
+</div>

From fc2ecce4ef7d31bd570fe4be1285fd55dd85af46 Mon Sep 17 00:00:00 2001
From: Conduitry <git@fur.army>
Date: Thu, 8 Feb 2018 14:29:38 -0500
Subject: [PATCH 4/5] make test more robust

---
 .../non-root-style-interpolation/_config.js   | 21 +++++++++++++++++++
 .../non-root-style-interpolation/main.html    | 21 +++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/test/runtime/samples/non-root-style-interpolation/_config.js b/test/runtime/samples/non-root-style-interpolation/_config.js
index a5d963e897..3585e61f0b 100644
--- a/test/runtime/samples/non-root-style-interpolation/_config.js
+++ b/test/runtime/samples/non-root-style-interpolation/_config.js
@@ -14,6 +14,27 @@ export default {
 			foo
 		</div>
 
+		<div>
+			<div>
+				<style>
+					div > div {
+						color: blue;
+					}
+				</style>
+				foo
+			</div>
+		</div>
+
+		<div>
+			<style>
+			/* something with < and > */
+				div {
+					color: red;
+				}
+			</style>
+			foo
+		</div>
+
 		<div>
 			<div>
 				<style>
diff --git a/test/runtime/samples/non-root-style-interpolation/main.html b/test/runtime/samples/non-root-style-interpolation/main.html
index 107c5e89ae..804d2a3ef2 100644
--- a/test/runtime/samples/non-root-style-interpolation/main.html
+++ b/test/runtime/samples/non-root-style-interpolation/main.html
@@ -8,6 +8,27 @@
 	foo
 </div>
 
+<div>
+	<div>
+		<style>
+			div > div {
+				color: blue;
+			}
+		</style>
+		foo
+	</div>
+</div>
+
+<div>
+	<style>
+	/* something with < and > */
+		div {
+			color: {{color}};
+		}
+	</style>
+	foo
+</div>
+
 <div>
 	<div>
 		<style>

From 7d514846313e48dca005050a1bda557463a7ef89 Mon Sep 17 00:00:00 2001
From: Conduitry <git@fur.army>
Date: Thu, 8 Feb 2018 19:31:42 -0500
Subject: [PATCH 5/5] simplify toHTML by relying on node.parent

---
 src/generators/nodes/Element.ts | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/generators/nodes/Element.ts b/src/generators/nodes/Element.ts
index b1bd650bf7..c70f22b447 100644
--- a/src/generators/nodes/Element.ts
+++ b/src/generators/nodes/Element.ts
@@ -232,7 +232,7 @@ export default class Element extends Node {
 				);
 			} else {
 				block.builders.create.addLine(
-					`${name}.innerHTML = ${stringify(this.children.map(node => toHTML(node, false)).join(''))};`
+					`${name}.innerHTML = ${stringify(this.children.map(toHTML).join(''))};`
 				);
 			}
 		} else {
@@ -414,9 +414,13 @@ export default class Element extends Node {
 			);
 		}
 
-		function toHTML(node: Element | Text, dontEscapeText: Boolean) {
+		function toHTML(node: Element | Text) {
 			if (node.type === 'Text') {
-				return dontEscapeText ? node.data : escapeHTML(node.data);
+				return node.parent &&
+					node.parent.type === 'Element' &&
+					(node.parent.name === 'script' || node.parent.name === 'style')
+					? node.data
+					: escapeHTML(node.data);
 			}
 
 			let open = `<${node.name}`;
@@ -435,9 +439,7 @@ export default class Element extends Node {
 
 			if (isVoidElementName(node.name)) return open + '>';
 
-			const shouldNotEscapeText = node.name === 'script' || node.name === 'style';
-
-			return `${open}>${node.children.map(node => toHTML(node, shouldNotEscapeText)).join('')}</${node.name}>`;
+			return `${open}>${node.children.map(toHTML).join('')}</${node.name}>`;
 		}
 	}