search

mozilla / bleach

Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes
https://bleach.readthedocs.io/en/latest/
Other
2.65k stars 253 forks source link

querystring tests #632

Closed jvanasco closed 2 years ago

jvanasco commented 2 years ago

Included are three tests, which I believe should pass in the current version of bleach. They're from an internal suite that is pinned to an earlier release.

The tests just apply clean and linkify to urls that have (i) a querystring, with (ii) a normal querystring separator (&), and (iii) an html encoded separator (&). The expected output based on historical bleach behavior is that BOTH the raw (&) and html encoded (&) should be encoded to the html encoding (&).

Background:

Our application allows users to edit content. We ran into a double-encoding issue with query args in some contexts. These tests helped us rule out the issue coming from bleach, as the bleach test-suite did not cover query args.

willkg commented 2 years ago

Thank you for doing this!

willkg commented 2 years ago

I looked at 3.10 support and it turns out @g-k did it already in 4ce3b35a and you've got an old version of the main branch.

I like the idea behind this PR. If you want, I can close this PR and add the additional tests. That'll reduce the additional work on your part.

Let me know what you want to do.

jvanasco commented 2 years ago

I like the idea behind this PR. If you want, I can close this PR and add the additional tests. That'll reduce the additional work on your part.

That would be great. I'm not going to have a time block to touch this until next week.

sorry about the stale branch. something got out of sync on my end during the fix to rename the default branch "main".

willkg commented 2 years ago

No worries! You do a ton of work on Bleach and I appreciate it. I'll try to get to this this week.

willkg commented 2 years ago

I redid this in #641.

jvanasco commented 2 years ago

Thanks. Next time I find missed edge cases, I'll work it into a parametized test if possible.

I still haven't pinpointed the regression on my end!