Repository navigation
Conversation
The absolute writers (-K, -K3, -K5, external links, -x's ?link= and applet code=) copied the host and path through an escaper that only handles &, so a link to a"onmouseover=... came out with a raw " that closed the attribute. They now percent-encode " ' < > as well, also inside a script, where the HTML escaper is skipped. Test 768 crawls a fixture under the default, -K, -K3 and -x options. A corpus line in tools/parser-corpus/absolute.html lets parser-diff see the change on its legs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
HT_ADD_URL_HTMLESCAPED also turns & into &, HT_ADD_URL_PCTQUOTES leaves it raw. The applet codebase and code values now go through the html variant, so a raw & no longer reaches those attributes. Test 768 now covers a quote in the host, the applet codebase and code values, and a script string under -K and -K3, which keeps & raw. The fixtures join EXTRA_DIST so distcheck ships them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
xroche
enabled auto-merge (squash)
November 7, 2026 19:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The parser now percent-encodes
",',<and>in the host and path of the absolute links it writes. This covers-K,-K3,-K5, external links, the?link=of-xand appletcode=. Before, a link toa"onmouseover=...came out with a raw", which closed thehrefand made the rest of the URL an attribute.Relative links were already safe, and
&still comes out as&. On everytools/parser-diff.shleg, only links holding those four characters differ fromorigin/master(its--self-checkpasses). Test 768 fails onorigin/master, and it fails again when any one of 7 writer sites is reverted. The 8th site sits in a branch that never runs.