support html5 parsing #158
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
flavorjones
force-pushed
the
flavorjones-support-html5-parsing
branch
2 times, most recently
from
4d48090
to
2774a3d
Compare
Usage was removed in #156
These are the methods used by Rails. Also move these methods into the Sanitizer class definition.
because we're preparing to extract fragment parsing
flavorjones
force-pushed
the
flavorjones-support-html5-parsing
branch
from
2774a3d
to
d8e3251
Compare
rafaelfranca
approved these changes
May 12, 2023
- parse_fragment - scrub - serialize These are composed in each sanitizer's `#sanitize` method. We're preparing to make html4 and html5 variations and I'd like to use mixins for code reuse.
The three concerns are: - fragment parsing - scrubbing - serialization These are combined in a fourth concern which implements a `#sanitize` method that composes the other concerns like: serialize(scrub(parse_fragment(html))) This should enable us to easily add HTML5 fragment parsing in a subsequent commit.
but Rails::Html is an alias for backwards compatibility
and test that the sanitizer class names are HTML4 variations
create a new test class for each sanitizer
which use Loofah.html5_fragment. Note that we repeat the sanitizer tests for both variations using a module that's mixed into two test classes.
This feels pretty good, not gonna lie. The majority of tests that needed to change were the ones related to the CDATA node issues: https://github.com/flavorjones/loofah/blob/main/docs/2022-10-decision-on-cdata-nodes.md and I'm happy to see everything working as expected.
flavorjones
force-pushed
the
flavorjones-support-html5-parsing
branch
from
d8e3251
to
53e9aa8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR introduces new variations of
LinkSanitizer,FullSanitizer, andSafeListSanitizerthat use Loofah's (Nokogiri's) HTML5 parsing functionality.Rails::HTML5::FullSanitizerRails::HTML5::LinkSanitizerRails::HTML5::SafeListSanitizerIt also introduces a
Rails::HTML4module which is the new canonical home for the existing sanitizers (which implicity always used the HTML4 parser). Finally, theRails::Htmlmodule has been renamed toRails::HTML.The following aliases are maintained for backwards compatibility:
Rails::Htmlpoints toRails::HTMLRails::HTML::FullSanitizerpoints toRails::HTML4::FullSanitizerRails::HTML::LinkSanitizerpoints toRails::HTML4::LinkSanitizerRails::HTML::SafeListSanitizerpoints toRails::HTML4::SafeListSanitizerMiscellaneous other changes:
.rdoc_optionsfile and have added or removed:nodoc:as appropriaterubocopjob to CIassert_equalinstead ofassert_dom_equalto avoid obfuscationrails-dom-testingNotably this PR does not include integration with Rails. It offers up new Sanitizer classes that provide HTML5 parsing suitable for use by Rails, but making Rails choose the sanitizer flavor will be in a subsequent PR.