diff options
| author | Stefan Behnel <stefan_ml@behnel.de> | 2018-09-09 17:19:58 +0200 |
|---|---|---|
| committer | Stefan Behnel <stefan_ml@behnel.de> | 2018-09-09 17:19:58 +0200 |
| commit | 3f3082e0a67851cde26a48da3d1f4b75d8aa07ec (patch) | |
| tree | 5036884584dd19312c39908f8dffac91756912cc /src/lxml/html | |
| parent | 085ccc2c5d3da1cdf0c10246f7bcd6e2bd5fcb2d (diff) | |
| parent | 1dee355e83b1f524de7a772a8da941a186036bc2 (diff) | |
| download | python-lxml-3f3082e0a67851cde26a48da3d1f4b75d8aa07ec.tar.gz | |
Merge branch lxml-4.2 into master.
Diffstat (limited to 'src/lxml/html')
| -rw-r--r-- | src/lxml/html/clean.py | 5 | ||||
| -rw-r--r-- | src/lxml/html/tests/test_clean.txt | 6 |
2 files changed, 6 insertions, 5 deletions
diff --git a/src/lxml/html/clean.py b/src/lxml/html/clean.py index 8708a808..e37f1ef9 100644 --- a/src/lxml/html/clean.py +++ b/src/lxml/html/clean.py @@ -8,9 +8,10 @@ import re import copy try: from urlparse import urlsplit + from urllib import unquote_plus except ImportError: # Python 3 - from urllib.parse import urlsplit + from urllib.parse import urlsplit, unquote_plus from lxml import etree from lxml.html import defs from lxml.html import fromstring, XHTML_NAMESPACE @@ -477,7 +478,7 @@ class Cleaner(object): def _remove_javascript_link(self, link): # links like "j a v a s c r i p t:" might be interpreted in IE - new = _substitute_whitespace('', link) + new = _substitute_whitespace('', unquote_plus(link)) if _is_javascript_scheme(new): # FIXME: should this be None to delete? return '' diff --git a/src/lxml/html/tests/test_clean.txt b/src/lxml/html/tests/test_clean.txt index c78ab4f1..2824f64c 100644 --- a/src/lxml/html/tests/test_clean.txt +++ b/src/lxml/html/tests/test_clean.txt @@ -18,7 +18,7 @@ ... <body onload="evil_function()"> ... <!-- I am interpreted for EVIL! --> ... <a href="javascript:evil_function()">a link</a> -... <a href="j\x01a\x02v\x03a\x04s\x05c\x06r\x07i\x0Ep t:evil_function()">a control char link</a> +... <a href="j\x01a\x02v\x03a\x04s\x05c\x06r\x07i\x0Ep t%20:evil_function()">a control char link</a> ... <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==">data</a> ... <a href="#" onclick="evil_function()">another link</a> ... <p onclick="evil_function()">a paragraph</p> @@ -51,7 +51,7 @@ <body onload="evil_function()"> <!-- I am interpreted for EVIL! --> <a href="javascript:evil_function()">a link</a> - <a href="javascrip t:evil_function()">a control char link</a> + <a href="javascrip t%20:evil_function()">a control char link</a> <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==">data</a> <a href="#" onclick="evil_function()">another link</a> <p onclick="evil_function()">a paragraph</p> @@ -84,7 +84,7 @@ <body onload="evil_function()"> <!-- I am interpreted for EVIL! --> <a href="javascript:evil_function()">a link</a> - <a href="javascrip%20t:evil_function()">a control char link</a> + <a href="javascrip%20t%20:evil_function()">a control char link</a> <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==">data</a> <a href="#" onclick="evil_function()">another link</a> <p onclick="evil_function()">a paragraph</p> |