Comments (2)
Can reproduce this with vanilla Nokogiri:
irb(main):002:0> Nokogiri::HTML::DocumentFragment.parse('one < two')
=> #<Nokogiri::HTML::DocumentFragment:0x3fe1c94a40e4 name="#document-fragment" children=[#<Nokogiri::XML::Text:0x3fe1c9420078 "one ">]>
irb(main):003:0> Nokogiri::HTML::DocumentFragment.parse('one < two').to_s
=> "one "
So let's pool resources on sparklemotion/nokogiri#1419 instead of filing 4 issues. Thanks! ❤️
from rails-html-sanitizer.
Nokogiri is operating as expected here. Not sure there's anything anyone can do about invalid HTML being treated as invalid HTML by an HTML parser. Either avoid passing it into the HTML parser or else escape entities first.
from rails-html-sanitizer.
Related Issues (20)
- iframe are scrubbed by default? HOT 3
- test failures against current loofah/nokogiri HOT 6
- PermitScrubber treats ProcessingInstructions as Elements HOT 2
- `strip_tags(input).html_safe? # => false to true` ? HOT 8
- test failures when using loofah 2.13.0 and nokogiri 1.12.5 HOT 7
- Explore test failures with nokogiri v1.13.2 HOT 1
- Change in behavior caused by Nokogiri 1.13.5 HOT 2
- xss vulnerability in data URI HOT 2
- allow script tag HOT 3
- WhiteListSanitizer is sanitizing some contents of allowed attribute HOT 2
- Calling "Rails::Html::SafeListSanitizer.new(prune: true)" results in "ArgumentError (unknown keyword: :prune)" HOT 8
- Loading order is causing issues HOT 9
- Private reporting of a potential security vulnerability HOT 6
- In the sanitize method, the value of the `multiple` attribute of the html tag is missing. HOT 2
- Please add required_ruby_version to gemspec HOT 3
- Add an option to use `to_text` instead of `to_html` to `FullSanitizer` HOT 13
- The sanitization method changes the tag structure if there is a `<table>` tag inside an `<a>` tag. HOT 3
- Should 'class' be removed from the default safe list for attributes? HOT 1
- HTML5 SafeListSanitizer removes 'viewbox' even when allowed_attribute HOT 2
- explore: using rgrove/sanitize as the underlying sanitizer
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from rails-html-sanitizer.