Sanitizer: a newsletter's <title> showed as a line above the body
<title> is not an allowed tag, so nh3 unwrapped it and kept its text — "mailer", "Email template" or the subject rendered before the content. It is now dropped with its content, both in the sanitized HTML and in the text derived from HTML-only mail (snippet and search). SANITIZER_VERSION goes to 4 so stored bodies re-sanitize from the raw blob on next render. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
@@ -17,6 +17,19 @@ def test_scripts_and_handlers_are_removed() -> None:
|
||||
assert "hi" in result.html
|
||||
|
||||
|
||||
def test_document_title_is_not_rendered() -> None:
|
||||
# Newsletters put "mailer" or the subject in <title>; unwrapping the tag would
|
||||
# show it as a stray line above the body. Hidden preheaders keep their style.
|
||||
html = (
|
||||
"<html><head><title>mailer</title></head><body>"
|
||||
'<span style="display:none">preview</span><p>Hi</p></body></html>'
|
||||
)
|
||||
result = sanitize_html(html, MID)
|
||||
assert "mailer" not in result.html
|
||||
assert '<span style="display:none">preview</span>' in result.html
|
||||
assert "<p>Hi</p>" in result.html
|
||||
|
||||
|
||||
def test_remote_image_is_blocked_and_flagged() -> None:
|
||||
html = '<p>see <img src="http://tracker.example/pixel.gif"> this</p>'
|
||||
result = sanitize_html(html, MID)
|
||||
|
||||
Reference in New Issue
Block a user