"a" anchor wrapping a table gives wrong result
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.4k
- Forks
- 361
- Avg merge
- 3d 41m
- Merged PRs (30d)
- 2
Description
I have the following HTML5 document:
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" style="margin: 0; padding: 0">
<body>
<a href="https://example.com">
<table>
<tr>
<td>Hallo</td>
</tr>
</table>
</a>
</body>
</html>
If I purify it, I get this result:
<a href="https://example.com">
</a><table><tr><td>Hallo</td>
</tr></table>
The "a" anchor is not around the table anymore, but directly closed. The table is not clickable anymore.
I checked the w3c validator, and it does not output an error, so I think it is allowed to put a <table> inside an <a>.
How can I allow a <table> inside an <a>?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the provided HTML5 document through HTMLPurifier and trace how the sanitizer handles an anchor containing a table. Determine why the anchor is closed before the table; done means preserving the link around the table without permitting unsafe markup, with regression coverage for this document.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100