Description

Despite MoinMoin's claims, many generated pages are not valid HTML 4.01 (http://www.w3.org/TR/html401/).

Steps to reproduce

• Click on the "Valid HTML 4.01" link at the bottom to validate this page.

• Alternatively: validate HelpOnLists, HelpOnTables,or HelpOnMacros.

Example

Here is sample output of the W3 validator made from this page on (2006-02-17): validator_output_1.html

1. illegal </p> tags

Sometimes Moin adds </p> tags where they are illegal, For example when text is followed by the [[NewPage()]] macro:

Only for test purposes, don't use!!

/!\ Only for test purposes, don't use!! /!\
[[NewPage()]]

2. illegal <span> tags in tables

If the line_anchors feature in Moin is on, it generates <span> tags in tables where they are illegal (between </tr> and <tr>):

||table || row1||
||table || row2||

3. deprecated <ol> attributes

Numbered lists in Moin use the type and start attributes, which are deprecated and invalid in HTML 4.01 strict:

1. item 10

 1.#10 item 10

4. ampersands in URLs

Moin inserts unescaped URLs containing & characters into the page text. Should be &amp; instead. See http://www.htmlhelp.com/tools/validator/problems.html#amp

example: dont_upload_me

example: attachment:dont_upload_me

Short security note - the ampersand is passed in the static part of the URL, there is no XSS risk for this issue because of that.

I suggest additionally to look at the recommended by W3C use of ; instead of &. http://www.w3.org/TR/html4/appendix/notes.html#ampersands-in-uris

Details

5. XHTML Short Tags

Lots of shorttags like <br />, <hr />, and <img ... /> are still being used which aren't HTML4.01 Strict. A quick grep of the source shows these coming from a few places - i18n, fckdialog.py, multiconfig.py, htmlmarkup.py

• Validating SyntaxReference shows many examples.

Workaround

I have a patch here which fixes all problems 1-3. moin-html401.txt Only for the start attribute, no valid workaround exists, because the W3C recommendation (using the CSS attributes counter-reset and counter-increment) isn't supported by any current browser except Opera (http://www.blooberry.com/indexdot/css/supportkey/generate.htm).

The only workaround I can think of is using the HTML 4.01 transitional DTD instead of HTML 4.01 strict for all pages containing lists. At least the pages would validate again.

I just discovered 4. when I created this page (2006-02-17), so I have no workaround yet. Shoudn't be too hard, though.

Discussion

I am running moin with the patch above. My wiki is relatively small (~200pages) and English-only, so I can't oversee all possible complications.

Plan

• Priority:

• Assigned to: ThomasWaldmann

• Status: all patches except the ol css stuff committed as moin--main--1.5--patch-528

  • SHORTTAG still present as of v1.9.3

CategoryMoinMoinBug CategoryMoinMoinBug