Closed yangbongsoo closed 4 years ago
Hmm. Since this was initially written, https://html.spec.whatwg.org/#named-character-references clarified which named character references are allowed without a trailing semicolon.
I believe, according to html.spec.whatwg, that ¤
is allowed without a semicolon because there are two entries in that table, one of which does not have a trailing ;
:
Name Character Glyph curren; U+000A4 ¤ curren U+000A4 ¤
Maybe we should just derive a list of HTML entities that are allowed without semicolons instead of looking for extra letters.
Does https://github.com/OWASP/java-html-sanitizer/pull/201 do what you need?
yes. I close this PR.
193 becaue of
_
char,order
string find it in ENTITY_TRIE and replaceℴ
I think
-
and_
may be treated in plain letters. Please tell me if you think I'm wrong or if I lack a test.