As Weston mentioned, adding this to the post content:
Hello <script>document.write('world');</script>
Produced:
This looks to be related to how process_node() gets the $attr_spec_list.
In some cases, all will have an equal 'score,'
As indicated in $spec_ids_sorted.
And sometimes, all of them will be missing a mandatory attribute.
In that case, $attr_spec_list will be empty.
If it is, use the first spec list in:
$rule_spec_list_to_validate.
This will need regression testing.

There was an error on the Travis build:
Can't use function return value in write context.
So store the result of reset() in $first_spec_list.

This has a mandatory attribute.
And per the previous commits,
It should fail validation.

Address an issue where <script> tags aren't stripped.

…anitize-invalid-script-json

…anitize-invalid-script-json