Skip to content

Commit

Permalink
Revert "bpo-35603: Escape table header of make_table output that can …
Browse files Browse the repository at this point in the history
…cause potential XSS. (pythonGH-11341)" (pythonGH-11356)

This reverts commit 78de011.
  • Loading branch information
serhiy-storchaka authored Jan 2, 2019
1 parent 3a374e0 commit 830ddc7
Show file tree
Hide file tree
Showing 3 changed files with 0 additions and 15 deletions.
4 changes: 0 additions & 4 deletions Lib/difflib.py
Original file line number Diff line number Diff line change
Expand Up @@ -2036,10 +2036,6 @@ def make_table(self,fromlines,tolines,fromdesc='',todesc='',context=False,
s.append( fmt % (next_id[i],next_href[i],fromlist[i],
next_href[i],tolist[i]))
if fromdesc or todesc:
fromdesc = fromdesc.replace("&", "&").replace(">", ">") \
.replace("<", "&lt;")
todesc = todesc.replace("&", "&amp;").replace(">", "&gt;") \
.replace("<", "&lt;")
header_row = '<thead><tr>%s%s%s%s</tr></thead>' % (
'<th class="diff_next"><br /></th>',
'<th colspan="2" class="diff_header">%s</th>' % fromdesc,
Expand Down
9 changes: 0 additions & 9 deletions Lib/test/test_difflib.py
Original file line number Diff line number Diff line change
Expand Up @@ -238,15 +238,6 @@ def test_html_diff(self):
with open(findfile('test_difflib_expect.html')) as fp:
self.assertEqual(actual, fp.read())

def test_make_table_escape_table_header(self):
html_diff = difflib.HtmlDiff()
output = html_diff.make_table(patch914575_from1.splitlines(),
patch914575_to1.splitlines(),
fromdesc='<from>',
todesc='<to>')
self.assertIn('&lt;from&gt;', output)
self.assertIn('&lt;to&gt;', output)

def test_recursion_limit(self):
# Check if the problem described in patch #1413711 exists.
limit = sys.getrecursionlimit()
Expand Down

This file was deleted.

0 comments on commit 830ddc7

Please sign in to comment.