Minor discrepancy with fromHtmlEscapedString

[lpsmith]

See jaspervdj/blaze-markup#15

fromHtmlEscapedString in 0.4 strips out '\DEL' as well as ASCII control characters, whereas the same function from 0.3 leaves them in.

e.g. with blaze-builder-0.3.3.2

ghci> toLazyByteString (fromHtmlEscapedString "\DEL<foobar>\STX")
"\DEL&lt;foobar&gt;\STX"

with blaze-builder-0.4.0.0

ghci> toLazyByteString (fromHtmlEscapedString "\DEL<foobar>\STX")
"&lt;foobar&gt;"

Possible fixes would be to 1) release a revision of the 0.3 series that also strips out control characters, 2) adjust 0.4 so that it doesn't, or 3) leave it as-is.

It certainly is my intention that 0.4 be semantically identical to 0.3, but I am curious what the correct behavior should be here with regards to html escaping, and how much trouble this discrepancy will actually cause. Control characters aren't kosher in HTML, but I don't know if they can actually lead to security vulnerabilities. Similarly, this discrepancy does cause problems with blaze-markup's test suite, but I don't know if it'll cause any trouble in "real" applications.

[lpsmith]

Ok, out of the 200 reverse dependencies of blaze-builder on hackage, there appears to be 3 direct reverse dependencies on fromHtmlEscapedString:

blaze-markup-0.6.3.0/src/Text/Blaze/Renderer/Utf8.hs
hackage-server-0.5.0/Distribution/Server/Framework/Templating.hs
lucid-2.9.1/src/Lucid/Base.hs

(This was done by scraping the package names out of the above link with grep and sed, cabal unpack each one of the results, then running grep -rl fromHtmlEscaped on the directory of unpacked packages.)

So if any maintainers of these packages would like to weigh in on this issue, I'm all ears. @dcoutts @jaspervdj @chrisdone

[lpsmith]

Of course, this change also has the potential to affect the output of each one of these packages, and thus any downstream dependencies of these packages as well.

[chrisdone]

I'm okay with this staying as-is. Given that it's an HTML5 parse error, even browsers would be legitimate in stripping it out, so relying on that for real applications is living on borrowed time anyway.

[jaspervdj]

I'm also fine with stripping out the control characters.