-
Notifications
You must be signed in to change notification settings - Fork 294
Quote attributes containing weird whitespace or '<' #11
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
The full list:
|
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
Jul 19, 2013
…legacy browsers These are mostly out of the market now, so this isn't massively needed any more; nevertheless, avoiding XSS as much as possible is inevitably desirable. This alters the API so that quote_attr_values is now a ternary setting, choosing between legacy-safe behaviour, spec behaviour, and always quoting.
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
Sep 19, 2013
…ing in legacy browsers
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
Sep 19, 2013
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
May 7, 2016
…legacy browsers These are mostly out of the market now, so this isn't massively needed any more; nevertheless, avoiding XSS as much as possible is inevitably desirable. This alters the API so that quote_attr_values is now a ternary setting, choosing between legacy-safe behaviour, spec behaviour, and always quoting.
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
May 7, 2016
…ing in legacy browsers
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
May 7, 2016
gsnedders
added a commit
that referenced
this issue
May 9, 2016
These are mostly out of the market now, so this isn't massively needed any more; nevertheless, avoiding XSS as much as possible is inevitably desirable. This alters the API so that quote_attr_values is now a ternary setting, choosing between legacy-safe behaviour, spec behaviour, and always quoting.
gsnedders
added a commit
that referenced
this issue
May 9, 2016
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
May 11, 2016
…legacy browsers These are mostly out of the market now, so this isn't massively needed any more; nevertheless, avoiding XSS as much as possible is inevitably desirable. This alters the API so that quote_attr_values is now a ternary setting, choosing between legacy-safe behaviour, spec behaviour, and always quoting.
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
May 11, 2016
…ing in legacy browsers
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
May 11, 2016
…ing in legacy browsers
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
May 11, 2016
…legacy browsers These are mostly out of the market now, so this isn't massively needed any more; nevertheless, avoiding XSS as much as possible is inevitably desirable. This alters the API so that quote_attr_values is now a ternary setting, choosing between legacy-safe behaviour, spec behaviour, and always quoting.
gsnedders
added a commit
to gsnedders/html5lib-python
that referenced
this issue
May 11, 2016
…ing in legacy browsers
gsnedders
added a commit
that referenced
this issue
May 17, 2016
Fix #11 by escaping enough to be safe in legacy browsers; r=nobody!
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
http://code.google.com/p/html5lib/issues/detail?id=93
Reported by zcorpan, Feb 27, 2009
Apr 27, 2009 excors
Apr 27, 2009 zcorpan
Sep 4, 2009 Simetrical
Sep 5, 2009 geoffers
Sep 6, 2009 zcorpan
Sep 7, 2009 Simetrical
Oct 28, 2009 geoffers
Oct 30, 2009 geoffers
This should presumably be a legacy_quote option or some such.
The text was updated successfully, but these errors were encountered: