Claude-generated POCs on 2 branches:

- `db/remove_html5lib_nh3` using nh3 (mature & maintained) but currently drops 
`<script>` and other disallowed tags instead of escaping them.  Also has a slow 
bs4 pass after nh3 for some things nh3 can't handle (iframe allowed only for 
youtube sources, input only for checkbox)
- `db/remove_html5lib_turbohtml` using turbohtml (very new right now, pre 1.0 
release, things may change in it).  Can't use its clean.sanitize for the same 
reasons nh3 fell short.  If turbohtml had a callback for custom sanitization, 
it would roughly halve the sanitizer code, and nearly all of the 
security-critical logic would be removed (relying on turbohtml).  Maybe 
placeholders could work, but fragile?  POC included for that

https://pypi.org/project/Pypeline/ will need changes too (shouldn't be too hard)


---

**[tickets:#8297] Consider changing from html5lib sanitizer**

**Status:** open
**Milestone:** unreleased
**Created:** Wed Jun 05, 2019 02:34 PM UTC by Dave Brondsema
**Last Updated:** Mon Jul 06, 2026 04:01 PM UTC
**Owner:** nobody


html5lib hasn't had a lot of activity or releases for a while.  bleach is no 
longer maintained either

We have customized behavior with our `ForgeHTMLSanitizerFilter` class, so it'll 
take careful work to make sure the right logic is still applied.

https://nh3.readthedocs.io/ is a popular successor

https://turbohtml.readthedocs.io/ is a very new alternative


---

Sent from forge-allura.apache.org because [email protected] is subscribed 
to https://forge-allura.apache.org/p/allura/tickets/

To unsubscribe from further messages, a project admin can change settings at 
https://forge-allura.apache.org/p/allura/admin/tickets/options.  Or, if this is 
a mailing list, you can unsubscribe from the mailing list.

Reply via email to