@@ -782,7 +782,7 @@ def allowed_token(self, token):
782
782
# characters, nor why we call unescape. I just know it's always been here.
783
783
# Should you be worried by this comment in a sanitizer? Yes. On the other hand, all
784
784
# this will do is remove *more* than it otherwise would.
785
- val_unescaped = re .sub ("[`\x00 -\x20 \x7f -\xa0 \s]+" , '' ,
785
+ val_unescaped = re .sub ("[`\x00 -\x20 \x7f -\xa0 \\ s]+" , '' ,
786
786
unescape (attrs [attr ])).lower ()
787
787
# remove replacement characters from unescaped characters
788
788
val_unescaped = val_unescaped .replace ("\ufffd " , "" )
@@ -807,7 +807,7 @@ def allowed_token(self, token):
807
807
' ' ,
808
808
unescape (attrs [attr ]))
809
809
if (token ["name" ] in self .svg_allow_local_href and
810
- (namespaces ['xlink' ], 'href' ) in attrs and re .search ('^\s*[^#\s].*' ,
810
+ (namespaces ['xlink' ], 'href' ) in attrs and re .search (r '^\s*[^#\s].*' ,
811
811
attrs [(namespaces ['xlink' ], 'href' )])):
812
812
del attrs [(namespaces ['xlink' ], 'href' )]
813
813
if (None , 'style' ) in attrs :
@@ -837,16 +837,16 @@ def disallowed_token(self, token):
837
837
838
838
def sanitize_css (self , style ):
839
839
# disallow urls
840
- style = re .compile ('url\s*\(\s*[^\s)]+?\s*\)\s*' ).sub (' ' , style )
840
+ style = re .compile (r 'url\s*\(\s*[^\s)]+?\s*\)\s*' ).sub (' ' , style )
841
841
842
842
# gauntlet
843
- if not re .match ("""^([:,;#%.\sa-zA-Z0-9!]|\w-\w|'[\s\w]+'|"[\s\w]+"|\([\d,\s]+\))*$""" , style ):
843
+ if not re .match (r """^([:,;#%.\sa-zA-Z0-9!]|\w-\w|'[\s\w]+'|"[\s\w]+"|\([\d,\s]+\))*$""" , style ):
844
844
return ''
845
- if not re .match ("^\s*([-\w]+\s*:[^:;]*(;\s*|$))*$" , style ):
845
+ if not re .match (r "^\s*([-\w]+\s*:[^:;]*(;\s*|$))*$" , style ):
846
846
return ''
847
847
848
848
clean = []
849
- for prop , value in re .findall ("([-\w]+)\s*:\s*([^:;]*)" , style ):
849
+ for prop , value in re .findall (r "([-\w]+)\s*:\s*([^:;]*)" , style ):
850
850
if not value :
851
851
continue
852
852
if prop .lower () in self .allowed_css_properties :
@@ -855,7 +855,7 @@ def sanitize_css(self, style):
855
855
'padding' ]:
856
856
for keyword in value .split ():
857
857
if keyword not in self .allowed_css_keywords and \
858
- not re .match ("^(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)$" , keyword ): # noqa
858
+ not re .match (r "^(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)$" , keyword ): # noqa
859
859
break
860
860
else :
861
861
clean .append (prop + ': ' + value + ';' )
0 commit comments