NotificationsYou must be signed in to change notification settings
Fork32k
Star67.3k

[3.14] gh-69426: HTMLParser: only unescape properly terminated character entities in attribute values (GH-95215)#133704

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

serhiy-storchaka merged 1 commit intopython:3.14frommiss-islington:backport-77b14a6-3.14

May 9, 2025

Merged

[3.14] gh-69426: HTMLParser: only unescape properly terminated character entities in attribute values (GH-95215)#133704

serhiy-storchaka merged 1 commit intopython:3.14frommiss-islington:backport-77b14a6-3.14

May 9, 2025

Conversation

Copy link

Contributor

miss-islington commentedMay 8, 2025•
edited by bedevere-appbot
Loading

According to the HTML5 spec, named character references in attribute values
should only be processed if they are not followed by an ASCII alphanumeric,
or an equals sign.
(cherry picked from commit77b14a6)

Co-authored-by: Sascha Ißbrückersascha.issbruecker@googlemail.com
https: //html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state

Issue:HTMLParser handle_starttag replaces entity references in attribute value even without semicolon #69426

pythongh-69426: HTMLParser: only unescape properly terminated charact…

9e56103

…er entities in attribute values (pythonGH-95215)According to the HTML5 spec, named character references in attribute valuesshould only be processed if they are not followed by an ASCII alphanumeric,or an equals sign.(cherry picked from commit77b14a6)Co-authored-by: Sascha Ißbrücker <sascha.issbruecker@googlemail.com>https: //html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state

miss-islington requested a review fromezio-melotti as acode owner

May 8, 2025 19:46

Copy link

python-cla-botbot commentedMay 8, 2025•
edited
Loading

All commit authors signed the Contributor License Agreement.

This was referencedMay 8, 2025

HTMLParser handle_starttag replaces entity references in attribute value even without semicolon#69426

Closed

gh-69426: only unescape properly terminated character entities in attribute values#95215

Merged

bedevere-appbot added the awaiting review label

May 8, 2025

Copy link

Member

hugovk commentedMay 8, 2025

@sissbruecker Please can you also sign the CLA with the email shown above? We need an entry for the ones used in commits and GitHub accounts, if they're different. Thank you!