3842ba31ab0b697b0d4026b5751da7dac7c84e35 braney Tue Sep 29 13:49:49 2026 -0700 htmlSanitize: keep the stdTbl and copyLinkSpan class names, refs #38126 GenArk description pages use these two classes from our own stylesheet and scripts: stdTbl for bordered tables, and copyLinkSpan with data-target for the Copy button next to the share link. They now come through, and data-target gets the same prefix as the id it names. Style values are now read the same way on every pass, so a page that is saved again comes out unchanged. Over the 5390-page hub corpus, 278 pages change, all in class or data-target only, and no page's text changes. diff --git src/lib/tests/htmlSanitizeTest.c src/lib/tests/htmlSanitizeTest.c index 6d4595e3670..e95f95f1134 100644 --- src/lib/tests/htmlSanitizeTest.c +++ src/lib/tests/htmlSanitizeTest.c @@ -1,121 +1,136 @@ /* htmlSanitizeTest - check that htmlSanitize keeps what it should and drops the rest. */ /* Copyright (C) 2026 The Regents of the University of California * See kent/LICENSE or http://genome.ucsc.edu/license/ for licensing information. */ #include "common.h" #include "htmlSanitize.h" static char *cases[] = { /* a whole pasted document comes out as the article it was meant to be */ "T" "

Head

Text

", /* script and style go, with their contents */ "

before

after

", /* a script that is never closed takes the rest with it */ "

before

" "" "" "" "

text

", /* a fill or a stroke cannot fetch anything, however the url is spelled */ "" "", /* a shape that only clips another is not drawn on its own */ "" "", /* a shape outside a drawing loses its tag */ "text after", +/* a class survives only when it is one of ours */ +"
cell
", +/* the share link on a GenArk page keeps its copy button, and the button still finds the link */ +"https://http_host/h/GCA_1" + "", +/* a quote written as a reference does not cut the declaration in two, so our own output + * reads back unchanged */ +"

a

", +/* nor does the semicolon of a number, and the declaration after a refused one survives */ +"

a

", +"

a

", +/* a name a browser would decode to a parenthesis is refused */ +"

a

", +/* a name a browser does not know leaves its semicolon to end the declaration */ +"

a

", }; int main(int argc, char *argv[]) { int i; for (i = 0; i < ArraySize(cases); ++i) { char *clean = htmlSanitize(cases[i]); printf("in : %s\nout: %s\n", cases[i], clean); struct slName *removed = NULL, *el; freeMem(clean); clean = htmlSanitizeReport(cases[i], &removed); for (el = removed; el != NULL; el = el->next) printf(" (%s)\n", el->name); printf("\n"); freeMem(clean); slFreeList(&removed); } /* Running the filter over its own output has to leave it alone. hgCustom hands the text * we returned back to us when a custom track is edited and saved again, so anything that * changes on a second pass changes a little more on every save. Any case that is not * settled prints here, and the expected output is the record of which ones those are. */ for (i = 0; i < ArraySize(cases); ++i) { char *once = htmlSanitize(cases[i]); char *twice = htmlSanitize(once); if (differentString(once, twice)) printf("not settled:\n once : %s\n twice: %s\n\n", once, twice); freeMem(once); freeMem(twice); } if (htmlSanitize(NULL) != NULL) errAbort("htmlSanitize(NULL) should be NULL"); return 0; }