Sanitizer: a newsletter's <title> showed as a line above the body
<title> is not an allowed tag, so nh3 unwrapped it and kept its text — "mailer", "Email template" or the subject rendered before the content. It is now dropped with its content, both in the sanitized HTML and in the text derived from HTML-only mail (snippet and search). SANITIZER_VERSION goes to 4 so stored bodies re-sanitize from the raw blob on next render. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
@@ -17,7 +17,7 @@ import nh3
|
||||
|
||||
# Bump when the sanitization policy changes; body_parts.sanitizer_v records it so a
|
||||
# render re-sanitizes stale content from the raw blob (SPEC §10.4).
|
||||
SANITIZER_VERSION = 3
|
||||
SANITIZER_VERSION = 4
|
||||
|
||||
_ALLOWED_TAGS: set[str] = {
|
||||
# structure
|
||||
@@ -218,8 +218,10 @@ def sanitize_html(
|
||||
link_rel="noopener noreferrer nofollow",
|
||||
strip_comments=True,
|
||||
# nh3 strips <script>/<style> *content* by default; we allow <style> (above)
|
||||
# and sanitize its CSS ourselves, so only script content is stripped here.
|
||||
clean_content_tags={"script"},
|
||||
# and sanitize its CSS ourselves, so its content stays. <title> is dropped
|
||||
# with its text: as a disallowed tag nh3 would unwrap it, and the document
|
||||
# title ("mailer", the subject) would render as a line above the body.
|
||||
clean_content_tags={"script", "title"},
|
||||
attribute_filter=attribute_filter,
|
||||
)
|
||||
cleaned = _sanitize_style_elements(cleaned, allow_remote_images, state)
|
||||
|
||||
Reference in New Issue
Block a user