c01de718b2fb8e7706a0fede0e5ea4149ac6f378
braney
Mon Aug 31 13:48:13 2026 -0700
htmlSanitize: six fixes from a second review of it, refs #38126
Filter the style attribute on the text a browser will see. A browser turns a
character reference into the character it names before the CSS parser runs, so
a value spelled url( reached the page as url( and walked past the check
that is there to stop it. The value is decoded before the check now, and the
author is told which property lost its value.
Say something when we drop the rest of the page. A tag that never ends, most
often an attribute value whose quote is never closed, threw away everything
after it and reported nothing, so hubCheck stayed quiet about it. The depth
cap did the same.
Write a less than sign that starts no tag as <. A browser reads text like
"', which could
eat a closing tag we added.
Write an attribute once. A browser keeps the first of a repeated attribute and
drops the rest. We checked the first and then printed them all, which was only
correct because of that rule.
Do not stack a second descPage- prefix on an id we already renamed, and do not
add a second noopener noreferrer to a rel that already has one. hgCustom hands
the text we returned back to us when a custom track is edited and saved again,
so both of these grew a little more on every save.
The test now re-runs the filter over its own output and prints any case that
changes, so a transform that compounds shows up in the diff.
diff --git src/lib/tests/expected/htmlSanitizeTest src/lib/tests/expected/htmlSanitizeTest
index 9cdddbdf030..4e52ec6ac03 100644
--- src/lib/tests/expected/htmlSanitizeTest
+++ src/lib/tests/expected/htmlSanitizeTest
@@ -1,75 +1,96 @@
in : THead
Text
out: Head
Text
in : before
after
out: before
after
(removed the script element and everything inside it)
(removed the style element and everything inside it)
in : before