Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Commitfe1baa8

Browse files
committed
Fix#11,#12: quote attributes that need escaping in legacy browsers
These are mostly out of the market now, so this isn't massivelyneeded any more; nevertheless, avoiding XSS as much as possible isinevitably desirable.This alters the API so that quote_attr_values is now a ternarysetting, choosing between legacy-safe behaviour, spec behaviour, andalways quoting.
1 parent1c32730 commitfe1baa8

File tree

1 file changed

+13
-6
lines changed

1 file changed

+13
-6
lines changed

‎html5lib/serializer/htmlserializer.py‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,13 @@
1111
spaceCharacters="".join(spaceCharacters)
1212

1313
quoteAttributeSpec=re.compile("["+spaceCharacters+"\"'=<>`]")
14+
quoteAttributeLegacy=re.compile("[\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n"
15+
"\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15"
16+
"\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
17+
"\x20\x2f\x60\xa0\u1680\u180e\u180f\u2000"
18+
"\u2001\u2002\u2003\u2004\u2005\u2006\u2007"
19+
"\u2008\u2009\u200a\u2028\u2029\u202f\u205f"
20+
"\u3000]")
1421

1522
try:
1623
fromcodecsimportregister_error,xmlcharrefreplace_errors
@@ -72,7 +79,7 @@ def htmlentityreplace_errors(exc):
7279
classHTMLSerializer(object):
7380

7481
# attribute quoting options
75-
quote_attr_values=False
82+
quote_attr_values="legacy"
7683
quote_char='"'
7784
use_best_quote_char=True
7885

@@ -108,9 +115,9 @@ def __init__(self, **kwargs):
108115
inject_meta_charset=True|False
109116
Whether it insert a meta element to define the character set of the
110117
document.
111-
quote_attr_values=True|False
118+
quote_attr_values="legacy"|"spec"|True
112119
Whether to quote attribute values that don't require quoting
113-
perHTML5 parsingrules.
120+
perlegacy browser behaviour, HTML authoringrules, or always.
114121
quote_char=u'"'|u"'"
115122
Use given quote character for attribute quoting. Default is to
116123
use double quote unless attribute value contains a double quote,
@@ -239,10 +246,10 @@ def serialize(self, treewalker, encoding=None):
239246
(knotinbooleanAttributes.get(name,tuple())and
240247
knotinbooleanAttributes.get("",tuple())):
241248
yieldself.encodeStrict("=")
242-
ifself.quote_attr_values:
249+
ifself.quote_attr_valuesorlen(v)==0:
243250
quote_attr=True
244-
else:
245-
quote_attr=len(v)==0orquoteAttributeSpec.search(v)
251+
elif:
252+
quoteAttributeSpec.search(v)
246253
v=v.replace("&","&amp;")
247254
ifself.escape_lt_in_attrs:
248255
v=v.replace("<","&lt;")

0 commit comments

Comments
 (0)

[8]ページ先頭

©2009-2025 Movatter.jp