diff options
| author | scoder <stefan_ml@behnel.de> | 2015-09-04 21:34:40 +0200 |
|---|---|---|
| committer | scoder <stefan_ml@behnel.de> | 2015-09-04 21:34:40 +0200 |
| commit | 813e566f27daa19b63a59a6750bcb99bd7a1760c (patch) | |
| tree | ff3e40c5ecea424e257b5ab09a80cf5c47d5d23c /src/lxml/html | |
| parent | 8ed1fa3d7a544b5ee38bd1d811b8726a86109012 (diff) | |
| parent | 763a7c4d05a6a9031e22488d834600610ce28762 (diff) | |
| download | python-lxml-813e566f27daa19b63a59a6750bcb99bd7a1760c.tar.gz | |
Merge pull request #162 from hbrunn/master-allow-image-dataurls
[IMP] allow dataurls if they point to images
Diffstat (limited to 'src/lxml/html')
| -rw-r--r-- | src/lxml/html/clean.py | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/lxml/html/clean.py b/src/lxml/html/clean.py index bbec243a..99fe42b1 100644 --- a/src/lxml/html/clean.py +++ b/src/lxml/html/clean.py @@ -70,9 +70,16 @@ _css_import_re = re.compile( # All kinds of schemes besides just javascript: that can cause # execution: -_is_javascript_scheme = re.compile( +_is_image_dataurl = re.compile( + r'^data:image/.+;base64', re.I).search +_is_possibly_malicious_scheme = re.compile( r'(?:javascript|jscript|livescript|vbscript|data|about|mocha):', re.I).search +def _is_javascript_scheme(s): + if _is_image_dataurl(s): + return None + return _is_possibly_malicious_scheme(s) + _substitute_whitespace = re.compile(r'[\s\x00-\x08\x0B\x0C\x0E-\x19]+').sub # FIXME: should data: be blocked? |