-
Notifications
You must be signed in to change notification settings - Fork 342
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use bleach for HTML sanitizing #257
Comments
Is there already work on this feature that could be tested? |
Not yet. It looks like it will take some effort and customization because bleach has extremely strict defaults.
|
@kurtmckee in looking at the code of Playing around it looks like all the tests pass if all the And then Those without delegation mean the one in |
A heads up — you probably don't to go down this road, as Bleach is deprecated because html5lib is not actively maintained (it's a bit circular 🙃). |
Closing this, as I'm not pursuing the Bleach route anymore. |
This will likely be a breaking change.
feedparser's HTML sanitizing should not rely on custom internal code anymore. Using an external package like bleach will allow feedparser to focus more closely on feed parsing, and allow developers to consolidate HTML sanitizing efforts so that everyone benefits.
Interestingly, browsing the source code for Mozilla's bleach module links to the WHAT-WG documentation which states that its early work was based on feedparser's HTML sanitizing, so it appears that things have come full circle in the last ~17 years!
Early testing suggests that this will affect feedparser's output so that it is HTML5 but perhaps not XHTML or HTML4. For example, quotes may or may not always be used with element attributes.
The text was updated successfully, but these errors were encountered: