NotificationsYou must be signed in to change notification settings
Fork32k
Star67.3k

[3.13] gh-69426: HTMLParser: only unescape properly terminated character entities in attribute values (GH-95215)#133586

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

serhiy-storchaka merged 1 commit intopython:3.13frommiss-islington:backport-77b14a6-3.13

May 9, 2025

Merged

[3.13] gh-69426: HTMLParser: only unescape properly terminated character entities in attribute values (GH-95215)#133586

serhiy-storchaka merged 1 commit intopython:3.13frommiss-islington:backport-77b14a6-3.13

May 9, 2025

Conversation

Copy link

Contributor

miss-islington commentedMay 7, 2025•
edited by bedevere-appbot
Loading

According to the HTML5 spec, named character references in attribute values
should only be processed if they are not followed by an ASCII alphanumeric,
or an equals sign.
(cherry picked from commit77b14a6)

Co-authored-by: Sascha Ißbrückersascha.issbruecker@googlemail.com
https: //html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state

Issue:HTMLParser handle_starttag replaces entity references in attribute value even without semicolon #69426

pythongh-69426: HTMLParser: only unescape properly terminated charact…

318884d

…er entities in attribute values (pythonGH-95215)According to the HTML5 spec, named character references in attribute valuesshould only be processed if they are not followed by an ASCII alphanumeric,or an equals sign.(cherry picked from commit77b14a6)Co-authored-by: Sascha Ißbrücker <sascha.issbruecker@googlemail.com>https: //html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state