Commita5efb0e

committed

Fix#153: Sanitizer fails to treat some attributes as URLs

Despite how this sounds, this has no known security implications.No known version of IE (5.5 to current), Firefox (3 to current),Safari (6 to current), Chrome (1 to current), or Opera (12 to current)will run any script provided in these attributes.

1 parente3bedc5 commita5efb0eCopy full SHA for a5efb0e

File tree

1 file changed

-2

lines changed

html5lib
- sanitizer.py

1 file changed

-2

lines changed

`‎html5lib/sanitizer.py‎`

Lines changed: 2 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -115,8 +115,8 @@ class HTMLSanitizerMixin(object):`
`115`	`115`	`'xml:base','xml:lang','xml:space','xmlns','xmlns:xlink','y',`
`116`	`116`	`'y1','y2','zoomAndPan']`
`117`	`117`
`118`		`-attr_val_is_uri= ['href','src','cite','action','longdesc','poster',`
`119`		`-'xlink:href','xml:base']`
	`118`	`+attr_val_is_uri= ['href','src','cite','action','longdesc','poster','background','datasrc',`
	`119`	`+'dynsrc','lowsrc','ping','poster','xlink:href','xml:base']`
`120`	`120`
`121`	`121`	`svg_attr_val_allows_ref= ['clip-path','color-profile','cursor','fill',`
`122`	`122`	`'filter','marker','marker-start','marker-mid','marker-end',`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commita5efb0e

File tree

1 file changed

1 file changed

`‎html5lib/sanitizer.py‎`

0 commit comments