f83fd4fd350727eb3a42a709849bab0c4658ab84
braney
Fri Aug 21 10:17:16 2026 -0700
htmlSanitize: three fixes from a review of it, refs #38126
Read the scheme of an href or src the way a browser arrives at it. A browser
turns a numeric character reference into its character before it decides what
the scheme is, and it accepts one written with any number of leading zeros and
with no closing semicolon at all. Decode those the same way, then insist that
what stands in front of the first slash is either a plain scheme we allow or a
plain path. A named entity, a backslash or a control character in that part of
the value means we do not print the link, because those are the ways the check
gets walked around. This keeps the 33 encoded mailto links two hubs write, and
they were the only links in the public hubs the plainer rule would have lost.
Treat a trailing slash on a kept element as the nothing that HTML says it is.
Otherwise came out as an open div and the rest of our own page sat
inside it.
Remember when the search for a closing tag has run off the end of the input.
Every later search for that same tag runs off the end too, so a page made of
two hundred thousand unclosed tags no longer costs one pass over the page each.
The unit test grows a case for each of the three.
diff --git src/lib/tests/expected/htmlSanitizeTest src/lib/tests/expected/htmlSanitizeTest
index 90d323314cd..6f778d66bfa 100644
--- src/lib/tests/expected/htmlSanitizeTest
+++ src/lib/tests/expected/htmlSanitizeTest
@@ -1,53 +1,72 @@
in : THead
Text
out: Head
Text
in : before
after
out: before
after
(removed the script element and everything inside it)
(removed the style element and everything inside it)
in : before