Dirk Mueller
2cc23971a9
* Add relative link to code of conduct. (#442) * Drop deprecated 'setup.py test' support. (#507) * Fix typo: curren -> current in tests/test_clean.py (#504) * Test on PyPy 7 * Drop test support for end of life Python 3.4 * ``bleach.clean`` behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and could result in a mutation XSS. Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or ``svg`` tags and one or more of the RCDATA tags ``script``, ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or ``xmp`` in the allowed tags whitelist were vulnerable to a mutation XSS. This security issue was confirmed in Bleach version v3.1.1. Earlier versions are likely affected too. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-bleach?expand=0&rev=32
49 lines
1.7 KiB
Diff
49 lines
1.7 KiB
Diff
--- bleach/html5lib_shim.py
|
|
+++ bleach/html5lib_shim.py
|
|
@@ -11,23 +11,23 @@
|
|
|
|
import six
|
|
|
|
-from bleach._vendor.html5lib import (
|
|
+from html5lib import (
|
|
HTMLParser,
|
|
getTreeWalker,
|
|
)
|
|
-from bleach._vendor.html5lib import constants
|
|
-from bleach._vendor.html5lib.constants import (
|
|
+from html5lib import constants
|
|
+from html5lib.constants import (
|
|
namespaces,
|
|
prefixes,
|
|
)
|
|
-from bleach._vendor.html5lib.constants import _ReparseException as ReparseException
|
|
-from bleach._vendor.html5lib.filters.base import Filter
|
|
-from bleach._vendor.html5lib.filters.sanitizer import allowed_protocols
|
|
-from bleach._vendor.html5lib.filters.sanitizer import Filter as SanitizerFilter
|
|
-from bleach._vendor.html5lib._inputstream import HTMLInputStream
|
|
-from bleach._vendor.html5lib.serializer import HTMLSerializer
|
|
-from bleach._vendor.html5lib._tokenizer import HTMLTokenizer
|
|
-from bleach._vendor.html5lib._trie import Trie
|
|
+from html5lib.constants import _ReparseException as ReparseException
|
|
+from html5lib.filters.base import Filter
|
|
+from html5lib.filters.sanitizer import allowed_protocols
|
|
+from html5lib.filters.sanitizer import Filter as SanitizerFilter
|
|
+from html5lib._inputstream import HTMLInputStream
|
|
+from html5lib.serializer import HTMLSerializer
|
|
+from html5lib._tokenizer import HTMLTokenizer
|
|
+from html5lib._trie import Trie
|
|
|
|
|
|
#: Map of entity name to expanded entity
|
|
--- tests/test_clean.py
|
|
+++ tests/test_clean.py
|
|
@@ -7,7 +7,7 @@
|
|
from bleach import clean
|
|
from bleach.html5lib_shim import Filter
|
|
from bleach.sanitizer import Cleaner
|
|
-from bleach._vendor.html5lib.constants import rcdataElements
|
|
+from html5lib.constants import rcdataElements
|
|
|
|
def test_clean_idempotent():
|
|
"""Make sure that applying the filter twice doesn't change anything."""
|