Rewrite to use html5lib >= 0.99999999 #250
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is a bleach rewrite to use the new sanitizer API in html5lib 0.99999999. The new API happens as a filter when emitting the tree rather than in the tokenizer. Because of that, the output of .clean() and .linkify() are different than in previous versions of bleach.
I also moved test_nasty to the regression tests because it's just like those.
* address FIXMEs * minor cleanup to code and comments
|
What's next:
|
* this adds some missing tests to add more coverage * html5lib 0.99999999 and 0.999999999 have an alphabeticalattributes filter that doesn't work when the attributes set has some items with a namespace and some without in Python 3; this rolls alphabetizing into the Bleach sanitizer * remove some dead code and clean some other code up
willkg
commented
Feb 24, 2017
| clean('<script/xss src="http://xx.com/xss.js"></script>') in | ||
| [ | ||
| '<script src="http://xx.com/xss.js" xss=""></script>', | ||
| '<script xss="" src="http://xx.com/xss.js"></script>' |
There was a problem hiding this comment.
I think to fix this we need to sort the attributes and then escape it. That happens in .disallowed_token in the sanitizer. I'll think about that.
Making this change means the output is stable since attributes will always happen in the same order. Seems like maybe it's not a great idea, but stable seems good. If it turns out this is terrible, someone will complain with a compelling use case and we can undo it. I also went through and removed a bunch of the "the output is either this or that" in the tests.
|
Ok. I think that's good enough for now. Merging. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This needs another going over. Plus I bumped into a few areas that don't have behavior tests, so it's possible there are things that are broken or not finished, yet. I'll keep working on those.
Fixes #229