Repository navigation
HTMLParser does not support escapable raw text mode (<textarea> and <title>) #118350
Description
Bug report
Bug description:
An example where parsing stops after the <style color="red">:
from html.parser import HTMLParser
from io import StringIO
class HTML2text(HTMLParser):
def __init__(self):
super().__init__()
self.data = StringIO()
def handle_data(self, html):
self.data.write(html)
def get_data(self):
return self.data.getvalue().strip()
html_test = '''
<!DOCTYPE html>
<head><title>Glued</title></head><body><some><style color="red">title</bar>
<h1>Spacious </h1><a href="https://heading.net">heading.net</a>
<span>not<a href="https://www.arpa.home">my.home.arpa</a><p> URL</p>
</body></html>
'''
parser = HTML2text()
parser.feed(html_test)
print(parser.get_data())Changing a single character in the word "style" restores the normal functionality.
CPython versions tested on:
3.11
Operating systems tested on:
Linux
Linked PRs
- gh-118350: Add escapable-raw-text mode to html parser #121770
- gh-118350: Fix support of elements "textarea" and "title" in HTMLParser #135310
- [3.14] gh-118350: Fix support of elements "textarea" and "title" in HTMLParser (GH-135310) #136984
- [3.13] gh-118350: Fix support of elements "textarea" and "title" in HTMLParser (GH-135310) #136985
- [3.12] gh-118350: Fix support of elements "textarea" and "title" in HTMLParser (GH-135310) #136986
- [3.11] gh-118350: Fix support of elements "textarea" and "title" in HTMLParser (GH-135310) #137782
- [3.10] gh-118350: Fix support of elements "textarea" and "title" in HTMLParser (GH-135310) #137783
- [3.9] gh-118350: Fix support of elements "textarea" and "title" in HTMLParser (GH-135310) #137784
Metadata
Metadata
Assignees
Labels
Projects
- Status
Activity
serhiy-storchaka commentedon Jul 14, 2025
Incorrect support of escapable raw text mode is a security issue. It allows to hide dangerous elements.
gh-118350: Fix support of elements "textarea" and "title" in HTMLPars…
pythongh-118350: Fix support of elements "textarea" and "title" in HT…
pythongh-118350: Fix support of elements "textarea" and "title" in HT…
pythongh-118350: Fix support of elements "textarea" and "title" in HT…
[3.14] gh-118350: Fix support of elements "textarea" and "title" in H…
[3.13] gh-118350: Fix support of elements "textarea" and "title" in H…
[3.12] gh-118350: Fix support of elements "textarea" and "title" in H…
[3.12] pythongh-118350: Fix support of elements "textarea" and "title…
pythongh-118350: Fix support of elements "textarea" and "title" in HT…
[3.11] pythongh-118350: Fix support of elements "textarea" and "title…
[3.10] pythongh-118350: Fix support of elements "textarea" and "title…
[3.9] pythongh-118350: Fix support of elements "textarea" and "title"…
pythongh-118350: Fix support of elements "textarea" and "title" in HT…
[3.14] pythongh-118350: Fix support of elements "textarea" and "title…
[3.9] gh-118350: Fix support of elements "textarea" and "title" in HT…
[3.11] gh-118350: Fix support of elements "textarea" and "title" in H…
[3.10] gh-118350: Fix support of elements "textarea" and "title" in H…
[html.parser] Fix stubtest for later patch releases
Fix raw markup inside <title> on Python 3.11.14
ui_test: fix HTML structure in testFolderWorkflowActionWithoutConfirm…