Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

[3.12] gh-135661: Fix CDATA section parsing in HTMLParser (GH-135665)#137774

Merged
Yhg1s merged 1 commit intopython:3.12python/cpython:3.12from
serhiy-storchaka:backport-0cbbfc4-3.12serhiy-storchaka/cpython:backport-0cbbfc4-3.12Copy head branch name to clipboard
Oct 6, 2025
Merged

[3.12] gh-135661: Fix CDATA section parsing in HTMLParser (GH-135665)#137774
Yhg1s merged 1 commit intopython:3.12python/cpython:3.12from
serhiy-storchaka:backport-0cbbfc4-3.12serhiy-storchaka/cpython:backport-0cbbfc4-3.12Copy head branch name to clipboard

Conversation

@serhiy-storchaka
Copy link
Member

@serhiy-storchaka serhiy-storchaka commented Aug 14, 2025 •
edited by bedevere-app bot
Loading

"] ]>" and "]] >" no longer end the CDATA section.

Make CDATA section parsing context depending.
Add private method HTMLParser._set_support_cdata() to change the context. If called with True, "<[CDATA[" starts a CDATA section which ends with "]]>". If called with False, "<[CDATA[" starts a bogus comments which ends with ">".

(cherry picked from commit 0cbbfc4)

@bedevere-app bedevere-app bot mentioned this pull request Aug 14, 2025
Open
@bedevere-app bedevere-app bot added the type-security A security issue label Aug 14, 2025
@bedevere-app bedevere-app bot mentioned this pull request Aug 14, 2025
Merged
@serhiy-storchaka
Copy link
Member Author

serhiy-storchaka commented Aug 14, 2025

Backports to 3.9-3.11 will be created from the 3.12 backport.

@serhiy-storchaka
Copy link
Member Author

serhiy-storchaka commented Aug 14, 2025

This code slightly differs from main. Unknown declarations (including CDATA) call handle_decl() instead of handle_comment() if they end with "]>". This is for larger compatibility with old code. But the first ">" ends them, according to the HTML specs.

@serhiy-storchaka
[3.12] pythongh-135661: Fix CDATA section parsing in HTMLParser (pyth…
1904262 
…onGH-135665)

"] ]>" and "]] >" no longer end the CDATA section.

Make CDATA section parsing  context depending.
Add private method HTMLParser._set_support_cdata() to change the context.
If called with True, "<[CDATA[" starts a CDATA section which ends with "]]>".
If called with False, "<[CDATA[" starts a bogus comments which ends with ">".
(cherry picked from commit 0cbbfc4)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@serhiy-storchaka
Copy link
Member Author

serhiy-storchaka commented Aug 17, 2025

This includes also #137873.

@Yhg1s Yhg1s merged commit dcf2476 into python:3.12 Oct 6, 2025
28 checks passed
@miss-islington-app
Copy link

miss-islington-app bot commented Oct 6, 2025

Thanks @serhiy-storchaka for the PR, and @Yhg1s for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 6, 2025
@serhiy-storchaka @miss-islington
[3.12] pythongh-135661: Fix CDATA section parsing in HTMLParser (pyth…
03909c0 
…onGH-135665) (pythonGH-137774)

"] ]>" and "]] >" no longer end the CDATA section.

Make CDATA section parsing  context depending.
Add private method HTMLParser._set_support_cdata() to change the context.
If called with True, "<[CDATA[" starts a CDATA section which ends with "]]>".
If called with False, "<[CDATA[" starts a bogus comments which ends with ">".
(cherry picked from commit 0cbbfc4)
(cherry picked from commit dcf2476)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 6, 2025
@serhiy-storchaka @miss-islington
[3.12] pythongh-135661: Fix CDATA section parsing in HTMLParser (pyth…
e139cb3 
…onGH-135665) (pythonGH-137774)

"] ]>" and "]] >" no longer end the CDATA section.

Make CDATA section parsing  context depending.
Add private method HTMLParser._set_support_cdata() to change the context.
If called with True, "<[CDATA[" starts a CDATA section which ends with "]]>".
If called with False, "<[CDATA[" starts a bogus comments which ends with ">".
(cherry picked from commit 0cbbfc4)
(cherry picked from commit dcf2476)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Oct 6, 2025

GH-139659 is a backport of this pull request to the 3.11 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 6, 2025
@serhiy-storchaka @miss-islington
[3.12] pythongh-135661: Fix CDATA section parsing in HTMLParser (pyth…
8ab85ab 
…onGH-135665) (pythonGH-137774)

"] ]>" and "]] >" no longer end the CDATA section.

Make CDATA section parsing  context depending.
Add private method HTMLParser._set_support_cdata() to change the context.
If called with True, "<[CDATA[" starts a CDATA section which ends with "]]>".
If called with False, "<[CDATA[" starts a bogus comments which ends with ">".
(cherry picked from commit 0cbbfc4)
(cherry picked from commit dcf2476)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Oct 6, 2025
@bedevere-app
Copy link

bedevere-app bot commented Oct 6, 2025

GH-139660 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Oct 6, 2025
@bedevere-app
Copy link

bedevere-app bot commented Oct 6, 2025

GH-139661 is a backport of this pull request to the 3.9 branch.

ambv pushed a commit that referenced this pull request Oct 7, 2025
@miss-islington @serhiy-storchaka
[3.11] gh-135661: Fix CDATA section parsing in HTMLParser (GH-135665) (…
22d5724 
…GH-137774) (GH-139659)

"] ]>" and "]] >" no longer end the CDATA section.

Make CDATA section parsing  context depending.
Add private method HTMLParser._set_support_cdata() to change the context.
If called with True, "<[CDATA[" starts a CDATA section which ends with "]]>".
If called with False, "<[CDATA[" starts a bogus comments which ends with ">".
(cherry picked from commit 0cbbfc4)
(cherry picked from commit dcf2476)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
ambv pushed a commit that referenced this pull request Oct 7, 2025
@miss-islington @serhiy-storchaka
[3.10] gh-135661: Fix CDATA section parsing in HTMLParser (GH-135665) (…
7317e0b 
…GH-137774) (GH-139660)

"] ]>" and "]] >" no longer end the CDATA section.

Make CDATA section parsing  context depending.
Add private method HTMLParser._set_support_cdata() to change the context.
If called with True, "<[CDATA[" starts a CDATA section which ends with "]]>".
If called with False, "<[CDATA[" starts a bogus comments which ends with ">".
(cherry picked from commit 0cbbfc4)
(cherry picked from commit dcf2476)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
ambv added a commit that referenced this pull request Oct 7, 2025
@miss-islington @serhiy-storchaka @ambv
[3.9] gh-135661: Fix CDATA section parsing in HTMLParser (GH-135665) (G…
ed904d5 
…H-137774) (GH-139661)

"] ]>" and "]] >" no longer end the CDATA section.

Make CDATA section parsing  context depending.
Add private method HTMLParser._set_support_cdata() to change the context.
If called with True, "<[CDATA[" starts a CDATA section which ends with "]]>".
If called with False, "<[CDATA[" starts a bogus comments which ends with ">".
(cherry picked from commit 0cbbfc4)
(cherry picked from commit dcf2476)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ezio-melotti ezio-melotti ezio-melotti approved these changes

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@serhiy-storchaka @ezio-melotti @Yhg1s
Morty Proxy This is a proxified and sanitized view of the page, visit original site.