Commit29526c5

committed

When URLs are invalid IPv6 URLs drop the attr rather than error

1 parent01b1ebb commit29526c5Copy full SHA for 29526c5

File tree

+10

-1

lines changed

+10

-1

lines changed

Lines changed: 5 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -207,7 +207,11 @@ def allowed_token(self, token, token_type):`
`207`	`207`	`unescape(attrs[attr])).lower()`
`208`	`208`	`# remove replacement characters from unescaped characters`
`209`	`209`	`val_unescaped=val_unescaped.replace("\ufffd","")`
`210`		`-uri=urlparse.urlparse(val_unescaped)`
	`210`	`+try:`
	`211`	`+uri=urlparse.urlparse(val_unescaped)`
	`212`	`+exceptValueError:`
	`213`	`+uri=None`
	`214`	`+delattrs[attr]`
`211`	`215`	`ifurianduri.scheme:`
`212`	`216`	`ifuri.schemenotinself.allowed_protocols:`
`213`	`217`	`delattrs[attr]`

Lines changed: 5 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -113,6 +113,11 @@ def test_sanitizer():`
`113`	`113`	`"<audio controls=\"\" src=\"data:foobar\"></audio>",`
`114`	`114`	`toxml)`
`115`	`115`
	`116`	`+yield (runSanitizerTest,"test_invalid_ipv6_url",`
	`117`	`+"<a>",`
	`118`	`+"<a href=\"h://]\">",`
	`119`	`+toxml)`
	`120`	`+`
`116`	`121`	`yield (runSanitizerTest,"test_data_uri_disallowed_type",`
`117`	`122`	`"<audio controls=\"\"></audio>",`
`118`	`123`	`"<audio controls=\"\" src=\"data:text/html,<html>\"></audio>",`

Comments

(0)