mirrors/bookwyrm
1
0
Fork 1
mirror of https://github.com/bookwyrm-social/bookwyrm.git synced 2024-06-11 01:39:23 +00:00
Code Issues Projects Releases Wiki Activity

Use "strip" in bleach

Browse source 
This removes forbidden html, rather than leaving them in place but
unrendered.
This commit is contained in:
Mouse Reeve 2022-07-04 13:45:28 -07:00
parent 70beb24d95
commit 9d9b7f366a
2 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
bookwyrm/tests/test_sanitize_html.py
View file

@ -32,14 +32,14 @@ class Sanitizer(TestCase):
self.assertEqual(output, '<a href="fish.com">yes </a> <i>html</i>')
def test_invalid_html(self):
"""remove all html when the html is malformed"""
"""don't allow malformed html"""
input_text = "<b>yes <i>html</i>"
output = clean(input_text)
self.assertEqual("yes html", output)
self.assertEqual("<b>yes <i>html</i></b>", output)
input_text = "yes <i></b>html </i>"
output = clean(input_text)
self.assertEqual("yes html ", output)
self.assertEqual("yes <i>html </i>", output)
def test_disallowed_html(self):
"""remove disallowed html but keep allowed html"""

1
bookwyrm/utils/sanitizer.py
View file

@ -22,4 +22,5 @@ def clean(input_text):
"li",
],
attributes=["href", "rel", "src", "alt"],
strip=True,
)