Skip to content

imomaliev/hugo-blockquote-summary-leak

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Blockquote leaks out to parent tag when cut by .Summary

This repo is reproduction of a quirk in Hugo's .Summary method. As the title implies, using a blockquote that extends past the .Summary cutoff causes the content below {{ .Summary }} to be treated as part of the blockquote until the end of the parent tag.

How to Run

$ hugo version
hugo v0.151.0+extended+withdeploy darwin/arm64 BuildDate=2025-10-02T13:30:36Z VendorInfo=brew
$ hugo server -D

You will see this

actual.png

Explanation

In most modern browsers this html code will be parsed and rendered without errors

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width">
</head>
<body>
  <main>
    <blockquote>
      <p>1</p>
  </main>
</body>
</html>

Leading to shown in browser as a source

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width">
</head>
<body>
  <main>
    <blockquote>
      <p>1</p>
      <!-- This blockquote end tag was automatically inserted -->
    </blockquote>
  </main>
</body>
</html>

This is due to these parsing rules

An end tag whose tag name is one of: "address", "article", "aside", "blockquote", "button", "center", "details", "dialog", "dir", "div", "dl", "fieldset", "figcaption", "figure", "footer", "header", "hgroup", "listing", "main", "menu", "nav", "ol", "pre", "search", "section", "select", "summary", "ul"

If the stack of open elements does not have an element in scope that is an HTML element with the same tag name as that of the token, then this is a parse error; ignore the token.

Otherwise, run these steps:

    Generate implied end tags.

    If the current node is not an HTML element with the same tag name as that of the token, then this is a parse error.

    Pop elements from the stack of open elements until an HTML element with the same tag name as the token has been popped from the stack.

About

Blockquote leaks out to parent tag when cut by .Summary

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

 
 
 

Contributors

Languages