Closed jtran closed 2 years ago
Looks like I introduced a bug when attempting to fix HREF santization: https://github.com/microcosm-cc/bluemonday/commit/f0057e2386fef8ce4ee3ede8a56b59d27449d49f
However when I remove the double-sanitizing in that and test the output of the tests I wrote for that code... it doesn't pose a risk.
That is, removing the double escaping still results in sanitized and safe to use output.
As such, I'm going to remove the part of that prior commit that led to the double escaping.
@buro9 will you be releasing a new version of bluemonday or should we (gitea) just pull a head?
Ah I see you've already released 1.0.19 - Thanks!
The values of attributes are getting double escaped. As far as I can tell, the problem was introduced in f0057e2386fef8ce4ee3ede8a56b59d27449d49f. In particular, the double-quote character and non-breaking spaces won't ever make it through sanitizing.
In code, I expect the following test to pass.
However, I get this output.