New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
bug: Relative url is removed when the allowed protocol is https #662
Comments
I verified this is still true of Bleach 5.0.0:
|
I think we should fix this. I can think of a couple of options:
I think I like option 2 more. @g-k What do you think? Can you think of a scenario where option 2 does the wrong thing? |
It's reasonable for users to expect bleach to match browser and 2.x behavior, but it'd be good to provide users an option to opt out too. So Option 2 seems preferable. We can update the default schemes later if we want to allow scheme-less URIs by default too.
Maybe if there's another protocol registered to We should clarify There is this caveat in the URL spec that I think we should follow:
Checking bleach and python Also, there's an older bug around rewriting the CSP's base-uri mitigates the risk of base overwriting too, so we should probably mention that stuff in the docs e.g. probably don't allow the |
I should have read more of the code. We have this currently: Lines 491 to 494 in ed06d4e
I think we should just change that to: if "http" in allowed_protocols or "https" in allowed_protocols:
return value Your comment has a bunch of other tasks: The caveat in the url spec is interesting, but I don't think we need to do anything here unless we find out browsers are doing the wrong thing. I'll write up a new issue to check the Bleach vendored I'm not sure I understand the thought about base url as an optional arg. That sounds like it should be a new issue. I'm not sure I understand the thought about CSP's base-uri, either, but that also sounds like it should be a new issue. |
Describe the bug
bleach.clean does not keep the relative url when the allowed protocol is https
Python and bleach versions
Steps to reproduce the behavior
Expected behavior
In bleach version 2.0.0, the relative url is not removed from the result:
'create new study <a href="/path/to/study">Mental study</a>'
Actual behavior
In bleach version 3.3.1, the relative url is removed from the result:
'create new study <a>Mental study</a>'
Additional context
Actual result in bleach 3.3.1
Expected result in bleach 2.0.0
The text was updated successfully, but these errors were encountered: