Claude-generated POCs on 2 branches: - `db/remove_html5lib_nh3` using nh3 (mature & maintained) but currently drops `<script>` and other disallowed tags instead of escaping them. Also has a slow bs4 pass after nh3 for some things nh3 can't handle (iframe allowed only for youtube sources, input only for checkbox) - `db/remove_html5lib_turbohtml` using turbohtml (very new right now, pre 1.0 release, things may change in it). Can't use its clean.sanitize for the same reasons nh3 fell short. If turbohtml had a callback for custom sanitization, it would roughly halve the sanitizer code, and nearly all of the security-critical logic would be removed (relying on turbohtml). Maybe placeholders could work, but fragile? POC included for that
https://pypi.org/project/Pypeline/ will need changes too (shouldn't be too hard) --- **[tickets:#8297] Consider changing from html5lib sanitizer** **Status:** open **Milestone:** unreleased **Created:** Wed Jun 05, 2019 02:34 PM UTC by Dave Brondsema **Last Updated:** Mon Jul 06, 2026 04:01 PM UTC **Owner:** nobody html5lib hasn't had a lot of activity or releases for a while. bleach is no longer maintained either We have customized behavior with our `ForgeHTMLSanitizerFilter` class, so it'll take careful work to make sure the right logic is still applied. https://nh3.readthedocs.io/ is a popular successor https://turbohtml.readthedocs.io/ is a very new alternative --- Sent from forge-allura.apache.org because [email protected] is subscribed to https://forge-allura.apache.org/p/allura/tickets/ To unsubscribe from further messages, a project admin can change settings at https://forge-allura.apache.org/p/allura/admin/tickets/options. Or, if this is a mailing list, you can unsubscribe from the mailing list.
