messense / messense/nh3

nh3 clean doesn't include html, head or body tags even when included in ALLOWED_TAGS

Open
#32 1 comment 1 reaction 0 assignees View on GitHub
upstream
Dominant language
Rust
Stars
393
Forks
17
Avg merge
5h 41m
Merged PRs (30d)
1

Description

While using nh3 library, we came across a use case, where HTML content is expected for a field, but we need to remove the content that can cause XSS attack. Using nh3.clean() directly on the input text doesn't give the expected result and a lot of useful data is getting trimmed ultimately modifying the html template input.

```python
import nh3
text = '''

HTML Tutorial

This is a heading


This is a paragraph.

'''

nh3.ALLOWED_TAGS.add('title')
nh3.ALLOWED_TAGS.add('head')
nh3.ALLOWED_TAGS.add('html')
nh3.ALLOWED_TAGS.add('div')
nh3.ALLOWED_TAGS.add('body')

print(nh3.clean(text,tags=nh3.ALLOWED_TAGS,strip_comments=False))

Output:
HTML Tutorial

This is a heading


This is a paragraph.


```

We don't want to trim the html or head or body tags. Is there any limitation to nh3 library which does not allow these tags?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the issue through the nh3.clean() Python entry point with the HTML sample and allowed tags shown. Read how the nh3 binding delegates sanitization to the Ammonia Rust crate, then verify that safe html, head, and body elements are preserved while unsafe content remains sanitized.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, rust
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.