You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
40 lines
1.4 KiB
40 lines
1.4 KiB
11 months ago
|
diff --git a/src/lxml/html/defs.py b/src/lxml/html/defs.py
|
||
|
|
index caf6b21..ea3c016 100644
|
||
|
|
--- a/src/lxml/html/defs.py
|
||
|
|
+++ b/src/lxml/html/defs.py
|
||
|
|
@@ -21,6 +21,8 @@ link_attrs = frozenset([
|
||
|
|
'usemap',
|
||
|
|
# Not standard:
|
||
|
|
'dynsrc', 'lowsrc',
|
||
|
|
+ # HTML5 formaction
|
||
|
|
+ 'formaction'
|
||
|
|
])
|
||
|
|
|
||
|
|
# Not in the HTML 4 spec:
|
||
|
|
diff --git a/src/lxml/html/tests/test_clean.py b/src/lxml/html/tests/test_clean.py
|
||
|
|
index 451eec2..e40cdad 100644
|
||
|
|
--- a/src/lxml/html/tests/test_clean.py
|
||
|
|
+++ b/src/lxml/html/tests/test_clean.py
|
||
|
|
@@ -89,6 +89,21 @@ class CleanerTest(unittest.TestCase):
|
||
|
|
b'<math><style>/* deleted */</style></math>',
|
||
|
|
lxml.html.tostring(clean_html(s)))
|
||
|
|
|
||
|
|
+ def test_formaction_attribute_in_button_input(self):
|
||
|
|
+ # The formaction attribute overrides the form's action and should be
|
||
|
|
+ # treated as a malicious link attribute
|
||
|
|
+ html = ('<form id="test"><input type="submit" formaction="javascript:alert(1)"></form>'
|
||
|
|
+ '<button form="test" formaction="javascript:alert(1)">X</button>')
|
||
|
|
+ expected = ('<div><form id="test"><input type="submit" formaction=""></form>'
|
||
|
|
+ '<button form="test" formaction="">X</button></div>')
|
||
|
|
+ cleaner = Cleaner(
|
||
|
|
+ forms=False,
|
||
|
|
+ safe_attrs_only=False,
|
||
|
|
+ )
|
||
|
|
+ self.assertEqual(
|
||
|
|
+ expected,
|
||
|
|
+ cleaner.clean_html(html))
|
||
|
|
+
|
||
|
|
|
||
|
|
def test_suite():
|
||
|
|
suite = unittest.TestSuite()
|