apostrophecms / sanitize-html

Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis. Built on htmlparser2 for speed and tolerance
MIT License
3.68k stars 349 forks source link

Another case of bad markup identified in Issue#549. Closing tags without having opening tags. Test cases also added. #568

Closed kedarchandrayan closed 1 year ago

kedarchandrayan commented 1 year ago

Summary

Closes #549

What are the specific steps to test this change?

The snippets given in the issues should now work as expected.

What kind of change does this PR introduce?

(Check at least one)

Make sure the PR fulfills these requirements:

If adding a new feature without an already open issue, it's best to open a feature request issue first and wait for approval before working on it.

Other information:

kedarchandrayan commented 1 year ago

Hello Team, cc: @boutell

Please review this change and let me know your comments.

Thanks in advance! Kedar Chandrayan

kedarchandrayan commented 1 year ago

Hello @boutell,

Thank you for the feedback. Following is my response, point-wise.

Markup like the following works fine, even after the change. htmlparser2 gives callbacks for both onopentag and onclosetag for the p tags, even if the closing p tags are not present.

<div>
<p>
<p>
<p>
</div>

I have added 2 test cases for the above markup as asked by you.

For self-closing tags, htmlparser2 gives consecutive callbacks for onopentag and onclosetag. For these, the tag goes in the stack and gets popped immediately. So these will also work with the change made.

Please let me know if anything else is needed from my end.

Thanks, Kedar Chandrayan

boutell commented 1 year ago

Thanks!

kedarchandrayan commented 1 year ago

Thank you @boutell 🙏