- Notifications
You must be signed in to change notification settings - Fork294
Move the sanitizer to purely be a filter.#110
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
hoppipolla-critic-bot commentedAug 27, 2013
Critic review:https://critic.hoppipolla.co.uk/r/287 This is an external review system which you may optionally use for the code review of your pull request. |
0fd13c6
to80a1425
Comparelandscape-bot commentedMay 17, 2016
|
I think when squashed this is now ready to land. |
landscape-bot commentedMay 17, 2016
|
As we no longer need the sanitizer to be shared between a filter anda tokenizer, move the entire sanitizer to the filter module.
This is imported into this repo as its expectations are very muchimplementation dependent, with expectations amended to match ouractual behaviour.
landscape-bot commentedMay 18, 2016
|
# Remove attributes with disallowed URL values | ||
for attr in (attr_names & self.attr_val_is_uri): | ||
assert attr in attrs | ||
# I don't have a clue where this regexp comes from or why it matches those |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
It looks like this regex is trying to remove:
` Literal backtic...\x00-\x20 Ascii table characters starting at NULL up to and including Space -- Mostly non-printable characters...\x7f-\xa0 Bytes with values 127 (DELETE) -> 160. More non-printable characters...\s Whitespace
I don't know why it would be doing these things ...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
My assumption is it's something to do with legacy attribute parsing in old UAs, for whom such characters can alter parsing.
This should be unneeded since the sanitizer changes (html5lib#110)
This should be unneeded since the sanitizer changes (html5lib#110)
Uh oh!
There was an error while loading.Please reload this page.
This drops support for the tokenizing side of thing, which is sadly the only side that works in previous releases.Fixes#72. See all discussion there.