diff --git a/frappe/tests/test_utils.py b/frappe/tests/test_utils.py index e903c655b0..e68e8372af 100644 --- a/frappe/tests/test_utils.py +++ b/frappe/tests/test_utils.py @@ -254,6 +254,13 @@ class TestHTMLUtils(unittest.TestCase): self.assertTrue("

Hello

" in clean) self.assertTrue('text' in clean) + def test_sanitize_html(self): + from frappe.utils.html_utils import sanitize_html + + clean = sanitize_html("
    ") + self.assertIn("ordered", clean) + self.assertNotIn("xyz", clean) + class TestValidationUtils(unittest.TestCase): def test_valid_url(self): diff --git a/frappe/utils/html_utils.py b/frappe/utils/html_utils.py index b9d0e8dfe2..fa84170330 100644 --- a/frappe/utils/html_utils.py +++ b/frappe/utils/html_utils.py @@ -162,7 +162,13 @@ def sanitize_html(html, linkify=False): + mathml_elements + ["html", "head", "meta", "link", "body", "style", "o:p"] ) - attributes = {"*": acceptable_attributes, "svg": svg_attributes} + + def attributes_filter(tag, name, value): + if name.startswith("data-"): + return True + return name in acceptable_attributes + + attributes = {"*": attributes_filter, "svg": svg_attributes} styles = bleach_allowlist.all_styles strip_comments = False