nh3 clean doesn't include html, head or body tags even when included in ALLOWED_TAGS
- Dominant language
- Rust
- Stars
- 393
- Forks
- 17
- Avg merge
- 5h 41m
- Merged PRs (30d)
- 1
Description
While using nh3 library, we came across a use case, where HTML content is expected for a field, but we need to remove the content that can cause XSS attack. Using nh3.clean() directly on the input text doesn't give the expected result and a lot of useful data is getting trimmed ultimately modifying the html template input.
```python
import nh3
text = '''
HTML Tutorial
This is a heading
This is a paragraph.
'''
nh3.ALLOWED_TAGS.add('title')
nh3.ALLOWED_TAGS.add('head')
nh3.ALLOWED_TAGS.add('html')
nh3.ALLOWED_TAGS.add('div')
nh3.ALLOWED_TAGS.add('body')
print(nh3.clean(text,tags=nh3.ALLOWED_TAGS,strip_comments=False))
Output:
HTML Tutorial
This is a heading
This is a paragraph.
```
We don't want to trim the html or head or body tags. Is there any limitation to nh3 library which does not allow these tags?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the issue through the nh3.clean() Python entry point with the HTML sample and allowed tags shown. Read how the nh3 binding delegates sanitization to the Ammonia Rust crate, then verify that safe html, head, and body elements are preserved while unsafe content remains sanitized.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100