search

yesodweb / haskell-xss-sanitize

prevent XSS attacks by sanitizing html (this is different then escaping!)
Other
20 stars 15 forks source link

filterTags escapes HTML entities because of TagSoup's defaults #26

Closed Skyfold closed 1 year ago

Skyfold commented 2 years ago 
*Text.HTML.SanitizeXSS> filterTags safeTags "text more text"
"text more text"

This would display as "text &nbspmore text" instead of "text more text".

If you add optEscape = id to the renderOptions then TagSoup will stop trying to escape &"<>

*Text.HTML.SanitizeXSS> filterTags safeTags "text&nbsp;more text"
"text&nbsp;more text"

If you are ok with this fix, I'll create a pull request with my changes.

snoyberg commented 2 years ago

Yes, that sounds reasonable.