gh-69426: only unescape properly terminated character entities in attribute values #95215

sissbruecker · 2022-07-24T19:14:41Z

Fixes HTMLParser to only unescape named character references in attribute values if they are properly terminated.

According to the HTML5 spec, named character references in attribute values should only be processed if they are not followed by an ASCII alphanumeric, or an equals sign. So the following references should be unescaped:

&cent
&cent foo
&cent-foo

While the following should not:

&center
&cent=

This change adds an attribute value specific character unescaping logic that should cover these cases.

Fixes: #69426

Issue: HTMLParser handle_starttag replaces entity references in attribute value even without semicolon #69426

…in attribute values

ghost · 2022-07-24T19:14:43Z

All commit authors signed the Contributor License Agreement.

sissbruecker · 2022-07-24T19:16:13Z

Lib/html/parser.py

@@ -57,6 +58,26 @@
 # </ and the tag name, so maybe this should be fixed
 endtagfind = re.compile(r'</\s*([a-zA-Z][-.a-zA-Z0-9:_]*)\s*>')

+# Character reference processing logic specific to attribute values
+# See: https://html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state
+attr_charref = re.compile(r'&(#[0-9]+|#[xX][0-9a-fA-F]+|[a-zA-Z][a-zA-Z0-9]*)[;=]?')


This partially duplicates an existing Regex, but I was not able to reuse the existing one for this purpose.

Since the issue only seems to affect named character references, is there a reason to include numeric charrefs too in this regex?

Yes, the new _unescape_attrvalue is effectively a wrapper for html.escape that only delegates to html.escape if the attribute specific conditions are met. Since we still want to escape numeric and hex char refs in attributes, we need to include them in the regex.

It would be better to move this immediately after the definition of entityref and charref. If we change one regexp, we will not forget to change the other.

sissbruecker · 2022-07-24T19:17:09Z

Lib/test/test_htmlparser.py

-        expected = [('starttag', 'a', [('href', 'foo"zar')]),
+        expected = [('starttag', 'a', [('href', 'foo " zar')]),
                    ('data', 'a"z'), ('endtag', 'a')]
        for charref in charrefs:
-            self._run_check('<a href="foo{0}zar">a{0}z</a>'.format(charref),
+            self._run_check('<a href="foo {0} zar">a{0}z</a>'.format(charref),
                            expected, collector=collector())
-        # check charrefs at the beginning/end of the text/attributes
+        # check charrefs at the beginning/end of the text
        expected = [('data', '"'),
-                    ('starttag', 'a', [('x', '"'), ('y', '"X'), ('z', 'X"')]),
+                    ('starttag', 'a', []),
                    ('data', '"'), ('endtag', 'a'), ('data', '"')]
        for charref in charrefs:
-            self._run_check('{0}<a x="{0}" y="{0}X" z="X{0}">'
+            self._run_check('{0}<a>'


Changed the existing tests to remove flawed assumptions about how the unescaping in attribute values should work.

It might be better to remove all attribute-related checks from this test, and move them in the next.

sissbruecker · 2022-07-24T19:17:33Z

Lib/test/test_htmlparser.py

+        # do unescape char refs at begging and end of text attributes
+        charrefs = ['&quot;', '&#34;', '&#x22;', '&quot', '&#34', '&#x22']
+        expected = [('starttag', 'a', [('x', '"'), ('y', '"-X'), ('z', 'X-"')]), ('endtag', 'a')]
+        for charref in charrefs:
+            self._run_check('<a x="{0}" y="{0}-X" z="X-{0}"></a>'.format(charref),
+                            expected, collector=collector())


Extracted this from test_convert_charrefs

sissbruecker · 2023-01-06T19:25:00Z

@ezio-melotti I see you are marked as code owner. Would there be any interest in moving ahead with this?

ezio-melotti

Thanks for the PR!
I left a few inline comments, but if you prefer I could also make the suggested changes myself and push them to your branch.

ezio-melotti · 2023-01-14T13:16:57Z

Lib/html/parser.py

@@ -57,6 +58,26 @@
 # </ and the tag name, so maybe this should be fixed
 endtagfind = re.compile(r'</\s*([a-zA-Z][-.a-zA-Z0-9:_]*)\s*>')

+# Character reference processing logic specific to attribute values
+# See: https://html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state
+attr_charref = re.compile(r'&(#[0-9]+|#[xX][0-9a-fA-F]+|[a-zA-Z][a-zA-Z0-9]*)[;=]?')


Since the issue only seems to affect named character references, is there a reason to include numeric charrefs too in this regex?

ezio-melotti · 2023-01-14T13:19:35Z

Lib/html/parser.py

+    return ref
+
+def unescape_attrvalue(s):
+    return attr_charref.sub(replace_attr_charref, s)


Both functions should be private, and their name prefixed by an _.

ezio-melotti · 2023-01-14T13:20:41Z

Lib/html/parser.py

+def replace_attr_charref(match):
+    ref = match.group(0)
+    # Numeric / hex char refs must always be unescaped
+    if ref[1] == '#':


Suggested change

if ref[1] == '#':

if ref.startswith('&#'):

I think this is clearer.

ezio-melotti · 2023-01-14T13:21:30Z

Lib/html/parser.py

+        return unescape(ref)
+    # Named character / entity references must only be unescaped
+    # if they are an exact match, and they are not followed by an equals sign
+    terminates_with_equals = ref[-1:] == '='


Suggested change

terminates_with_equals = ref[-1:] == '='

terminates_with_equals = ref.endswith('=')

ezio-melotti · 2023-01-14T13:34:38Z

Lib/test/test_htmlparser.py

-        expected = [('starttag', 'a', [('href', 'foo"zar')]),
+        expected = [('starttag', 'a', [('href', 'foo " zar')]),
                    ('data', 'a"z'), ('endtag', 'a')]
        for charref in charrefs:
-            self._run_check('<a href="foo{0}zar">a{0}z</a>'.format(charref),
+            self._run_check('<a href="foo {0} zar">a{0}z</a>'.format(charref),
                            expected, collector=collector())
-        # check charrefs at the beginning/end of the text/attributes
+        # check charrefs at the beginning/end of the text
        expected = [('data', '"'),
-                    ('starttag', 'a', [('x', '"'), ('y', '"X'), ('z', 'X"')]),
+                    ('starttag', 'a', []),
                    ('data', '"'), ('endtag', 'a'), ('data', '"')]
        for charref in charrefs:
-            self._run_check('{0}<a x="{0}" y="{0}X" z="X{0}">'
+            self._run_check('{0}<a>'


It might be better to remove all attribute-related checks from this test, and move them in the next.

ezio-melotti · 2023-01-14T13:39:22Z

Lib/test/test_htmlparser.py

+        expected = [('starttag', 'a',
+                     [('href', 'https://example.com?foo¢=123')]),
+                    ('endtag', 'a')]
+        self._run_check('<a href="https://example.com?foo&cent;=123"></a>', expected, collector=collector())


If possible, it would be better to match the style of the previous test, creating different lists of charrefs (e.g. valid, invalid, named, numeric, etc.) and add them in different places in the attribute (beginning, end, before an alnum/space/semicolon/equal).

Also try to keep the lines shorter than 80 chars (you can remove the initial part of the URLs, since they are not necessary).

Thanks, looking at it combining multiple cases in a single attribute is indeed hard to read. I restructured the test to have two scenarios:

terminated entity, numeric and hex char refs

unterminated entity char refs

Both include cases for start, middle, end, as well as followed by alphanumeric, non-alphanumeric and equals sign. I hope it's a bit clearer now.

Also updated formatting to respect the 80 char limit.

sissbruecker · 2023-02-06T14:36:05Z

Thanks for taking the time to review @ezio-melotti . I have addressed all comments. Could you please take another look when you find some time?

kurtqq · 2023-06-15T16:22:47Z

ping @ezio-melotti on this one would be nice to get it fixed

serhiy-storchaka · 2025-05-06T19:20:16Z

Lib/html/parser.py

@@ -57,6 +58,26 @@
 # </ and the tag name, so maybe this should be fixed
 endtagfind = re.compile(r'</\s*([a-zA-Z][-.a-zA-Z0-9:_]*)\s*>')

+# Character reference processing logic specific to attribute values
+# See: https://html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state
+attr_charref = re.compile(r'&(#[0-9]+|#[xX][0-9a-fA-F]+|[a-zA-Z][a-zA-Z0-9]*)[;=]?')


It would be better to move this immediately after the definition of entityref and charref. If we change one regexp, we will not forget to change the other.

Lib/html/parser.py

serhiy-storchaka

LGTM. 👍

Thank you for your contribution, @sissbruecker.

serhiy-storchaka · 2025-05-07T05:52:32Z

Lib/html/parser.py

@@ -23,6 +24,7 @@

 entityref = re.compile('&([a-zA-Z][-.a-zA-Z0-9]*)[^a-zA-Z0-9]')


I wonder why there are . and - symbols in the name here? It may not be related to this issue.

miss-islington-app · 2025-05-07T15:49:53Z

Thanks @sissbruecker for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

miss-islington-app · 2025-05-07T15:50:10Z

Sorry @sissbruecker and @serhiy-storchaka, I had trouble checking out the 3.14 backport branch.
Please retry by removing and re-adding the "needs backport to 3.14" label.
Alternatively, you can backport using cherry_picker on the command line.

cherry_picker 77b14a6d58e527f915966446eb0866652a46feb5 3.14

…er entities in attribute values (pythonGH-95215) According to the HTML5 spec, named character references in attribute values should only be processed if they are not followed by an ASCII alphanumeric, or an equals sign. (cherry picked from commit 77b14a6) Co-authored-by: Sascha Ißbrücker <[email protected]> https: //html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state

bedevere-app · 2025-05-07T15:50:32Z

GH-133586 is a backport of this pull request to the 3.13 branch.

miss-islington-app · 2025-05-08T19:46:19Z

Thanks @sissbruecker for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

…er entities in attribute values (pythonGH-95215) According to the HTML5 spec, named character references in attribute values should only be processed if they are not followed by an ASCII alphanumeric, or an equals sign. (cherry picked from commit 77b14a6) Co-authored-by: Sascha Ißbrücker <[email protected]> https: //html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state

bedevere-app · 2025-05-08T19:46:29Z

GH-133704 is a backport of this pull request to the 3.14 branch.

…ter entities in attribute values (GH-95215) (GH-133704) According to the HTML5 spec, named character references in attribute values should only be processed if they are not followed by an ASCII alphanumeric, or an equals sign. (cherry picked from commit 77b14a6) https: //html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state Co-authored-by: Sascha Ißbrücker <[email protected]>

…ter entities in attribute values (GH-95215) (GH-133586) According to the HTML5 spec, named character references in attribute values should only be processed if they are not followed by an ASCII alphanumeric, or an equals sign. (cherry picked from commit 77b14a6) https: //html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state Co-authored-by: Sascha Ißbrücker <[email protected]>

pythongh-69426: only unescape properly terminated character entities …

71a89f9

…in attribute values

sissbruecker requested a review from ezio-melotti as a code owner July 24, 2022 19:14

bedevere-bot added the awaiting review label Jul 24, 2022

sissbruecker commented Jul 24, 2022

View reviewed changes

fix typo

bebae0a

sissbruecker mentioned this pull request Jan 6, 2023

Unwanted modification of special URLs on import sissbruecker/linkding#291

Open

ezio-melotti reviewed Jan 14, 2023

View reviewed changes

sissbruecker added 3 commits January 14, 2023 19:16

Address review comments in parser.py

a7af750

Extract attribute tests from test_convert_charrefs

f915b19

Refactor attribute unescape tests

6c65830

bedevere-bot mentioned this pull request Jan 14, 2023

HTMLParser handle_starttag replaces entity references in attribute value even without semicolon #69426

Closed

sissbruecker requested a review from ezio-melotti January 14, 2023 19:31

Merge branch 'main' into pythongh-69426-htmlparser-attribute-entities

e8263ae

serhiy-storchaka self-requested a review May 6, 2025 19:17

serhiy-storchaka reviewed May 6, 2025

View reviewed changes

sissbruecker added 2 commits May 6, 2025 22:33

address review comments

ec1341b

fix docs class reference

fb77f97

serhiy-storchaka approved these changes May 7, 2025

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels May 7, 2025

serhiy-storchaka enabled auto-merge (squash) May 7, 2025 06:23

serhiy-storchaka added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels May 7, 2025

serhiy-storchaka merged commit 77b14a6 into python:main May 7, 2025
47 checks passed

bedevere-app bot removed the awaiting merge label May 7, 2025

miss-islington-app bot assigned serhiy-storchaka May 7, 2025

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label May 7, 2025

serhiy-storchaka added needs backport to 3.14 bugs and security fixes and removed needs backport to 3.14 bugs and security fixes labels May 8, 2025

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label May 8, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gh-69426: only unescape properly terminated character entities in attribute values #95215

gh-69426: only unescape properly terminated character entities in attribute values #95215

sissbruecker commented Jul 24, 2022 •

edited by bedevere-bot

Loading

ghost commented Jul 24, 2022 •

edited by ghost

Loading

sissbruecker Jul 24, 2022

ezio-melotti Jan 14, 2023

sissbruecker Jan 14, 2023

serhiy-storchaka May 6, 2025

sissbruecker May 6, 2025

sissbruecker Jul 24, 2022

ezio-melotti Jan 14, 2023

sissbruecker Jan 14, 2023

sissbruecker Jul 24, 2022

sissbruecker commented Jan 6, 2023

ezio-melotti left a comment

ezio-melotti Jan 14, 2023

ezio-melotti Jan 14, 2023

sissbruecker Jan 14, 2023

ezio-melotti Jan 14, 2023

sissbruecker Jan 14, 2023

ezio-melotti Jan 14, 2023

sissbruecker Jan 14, 2023

ezio-melotti Jan 14, 2023

ezio-melotti Jan 14, 2023

sissbruecker Jan 14, 2023

sissbruecker commented Feb 6, 2023

kurtqq commented Jun 15, 2023

serhiy-storchaka May 6, 2025

serhiy-storchaka left a comment

serhiy-storchaka May 7, 2025

miss-islington-app bot commented May 7, 2025

miss-islington-app bot commented May 7, 2025

bedevere-app bot commented May 7, 2025

miss-islington-app bot commented May 8, 2025

bedevere-app bot commented May 8, 2025

	terminates_with_equals = ref[-1:] == '='
	terminates_with_equals = ref.endswith('=')

		@@ -23,6 +24,7 @@

		entityref = re.compile('&([a-zA-Z][-.a-zA-Z0-9]*)[^a-zA-Z0-9]')

gh-69426: only unescape properly terminated character entities in attribute values #95215

gh-69426: only unescape properly terminated character entities in attribute values #95215

Conversation

sissbruecker commented Jul 24, 2022 • edited by bedevere-bot Loading

ghost commented Jul 24, 2022 • edited by ghost Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sissbruecker commented Jan 6, 2023

ezio-melotti left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sissbruecker commented Feb 6, 2023

kurtqq commented Jun 15, 2023

Choose a reason for hiding this comment

serhiy-storchaka left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

miss-islington-app bot commented May 7, 2025

miss-islington-app bot commented May 7, 2025

bedevere-app bot commented May 7, 2025

miss-islington-app bot commented May 8, 2025

bedevere-app bot commented May 8, 2025

sissbruecker commented Jul 24, 2022 •

edited by bedevere-bot

Loading

ghost commented Jul 24, 2022 •

edited by ghost

Loading