Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fork html5lib-python or find alternative #680

Closed
willkg opened this issue Oct 27, 2022 · 1 comment
Closed

fork html5lib-python or find alternative #680

willkg opened this issue Oct 27, 2022 · 1 comment
Labels
untriaged Bug reports that haven't been triaged

Comments

@willkg
Copy link
Member

willkg commented Oct 27, 2022

Bleach relies heavily on html5lib-python and that project has been vaguely maintained for some time. In 2019, I stepped up to push out a 1.0.0 release. It hasn't had a lot of activity since then. I think we should call it a dead project at this point.

We've looked at alternatives over the years, but haven't found anything that works well. Bleach has slightly different parsing needs than a library designed to parse html like a browser.

One alternative is to fork html5lib-python. That gives us a few things:

  1. if there's a security issue, we can solve it much more easily because the solution can be localized to Bleach
  2. we can begin to remove things we don't need that make Bleach hard to maintain
  3. we can fix some of the API which Bleach currently works around with the shim in high-risk ways
  4. we can modernize it--html5lib doesn't officially support Python > 3.8

Are there other viable alternatives? If so, can someone build a Bleach prototype with them?

If there are no viable alternatives, we should go with forking html5lib-python.

@willkg
Copy link
Member Author

willkg commented Oct 6, 2023

We're deprecating the project, so this is moot now.

@willkg willkg closed this as completed Oct 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
untriaged Bug reports that haven't been triaged
Projects
None yet
Development

No branches or pull requests

1 participant