Fix #11 by escaping enough to be safe in legacy browsers #95
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Critic review: https://critic.hoppipolla.co.uk/r/227 This is an external review system which you may optionally use for the code review of your pull request. |
|
The remaining failures are now-bogus tests in html5lib-tests (which expect spec behaviour by default, and not legacy-safe behaviour by default (which we want because of #12 — to be secure by default)). |
gsnedders
force-pushed
the
escape-characters-serializer
branch
from
b0eddff to
791533e
Compare
gsnedders
force-pushed
the
escape-characters-serializer
branch
from
791533e to
d87ca9b
Compare
gsnedders
force-pushed
the
escape-characters-serializer
branch
from
d87ca9b to
6ddce87
Compare
Current coverage is 89.37%@@ master #95 diff @@
==========================================
Files 50 50
Lines 6796 6809 +13
Methods 0 0
Messages 0 0
Branches 1318 1321 +3
==========================================
+ Hits 6071 6085 +14
+ Misses 555 553 -2
- Partials 170 171 +1
|
… per spec This also moves to using re, which seems far cleaner than the reduce-based search previously used.
gsnedders
force-pushed
the
escape-characters-serializer
branch
from
a30eb28 to
15ff801
Compare
…legacy browsers These are mostly out of the market now, so this isn't massively needed any more; nevertheless, avoiding XSS as much as possible is inevitably desirable. This alters the API so that quote_attr_values is now a ternary setting, choosing between legacy-safe behaviour, spec behaviour, and always quoting.
gsnedders
force-pushed
the
escape-characters-serializer
branch
from
8765511 to
9b8d8eb
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
#11 given this isn't picked up from the title