justhtml 3.11.2__tar.gz → 3.11.3__tar.gz

{justhtml-3.11.2 → justhtml-3.11.3}/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.11.3] - 2026-09-27
+
+### Fixed
+
+- Apply earlier transforms to allowed children hoisted when sanitization removes a parent (#85).
+- Drop foreign subtrees inside disallowed HTML parents in the default parsing path.
+
 ## [3.11.2] - 2026-08-27
 
 ### Fixed

{justhtml-3.11.2 → justhtml-3.11.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: justhtml
-Version: 3.11.2
+Version: 3.11.3
 Summary: A pure Python HTML5 parser that just works.
 Project-URL: Homepage, https://github.com/emilstenstrom/justhtml
 Project-URL: Issues, https://github.com/emilstenstrom/justhtml/issues

{justhtml-3.11.2 → justhtml-3.11.3}/docs/linkify.md

@@ -136,6 +136,7 @@ policy = SanitizationPolicy(
     allowed_attributes={"a": ["href"]},
     url_policy=UrlPolicy(allow_rules={("a", "href"): UrlRule(allowed_schemes={"https"})}),
 )
+# An example that uses HTTP, so it should NOT be allowed
 text = "See http://example.com"
 
 # Wrong: Linkify's generated <a href> is created after the sanitize point,
@@ -144,10 +145,10 @@ doc = JustHTML(text, transforms=[Sanitize(policy), Linkify()])
 print(doc.to_html(pretty=False))
 # => See <a href="http://example.com">http://example.com</a>
 
-# Right: Linkify runs first, so its output is covered by the same sanitize pass.
+# Correct: Linkify runs first, so its output is covered by the same sanitize pass.
 doc = JustHTML(text, transforms=[Linkify(), Sanitize(policy)])
 print(doc.to_html(pretty=False))
-# => See http://example.com
+# => See <a>http://example.com</a>
 ```
 
 If you don't need other transforms between them, the simplest safe option is to omit `Sanitize()` entirely and let `sanitize=True` (the default) append it automatically after `Linkify()`.

{justhtml-3.11.2 → justhtml-3.11.3}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "justhtml"
 authors = [{ name = "Emil Stenström", email = "emil@emilstenstrom.se" }]
-version = "3.11.2"
+version = "3.11.3"
 description = "A pure Python HTML5 parser that just works."
 readme = "README.md"
 license = { file = "LICENSE" }

{justhtml-3.11.2 → justhtml-3.11.3}/src/justhtml/parser/engine.py

@@ -4212,11 +4212,8 @@ class ParseEngine:
             self._foreign_context_seen = True
             self._nodes_to_unwrap.append(node)
             parent_namespace = getattr(parent, "namespace", None)
-            if parent is self._fragment_context_node or parent_namespace in {None, "html"}:
-                if not self._parser_only_template_depth and (
-                    parent is self._fragment_context_node or parent.name in self._allowed_tags
-                ):
-                    self._nodes_to_drop.append(node)
+            if parent is self._fragment_context_node or parent_namespace in {None, "html", _PARSER_ONLY_NAMESPACE}:
+                self._nodes_to_drop.append(node)
         elif name not in self._allowed_tags:
             self._nodes_to_unwrap.append(node)
         if not is_void:

{justhtml-3.11.2 → justhtml-3.11.3}/src/justhtml/transforms/runtime.py

@@ -231,7 +231,6 @@ def apply_compiled_transforms(
 
                 if moved:
                     for child in moved:
-                        _mark_start(child, mark_new_start_index)
                         child.parent = parent
                     replacement.extend(moved)
 
@@ -294,7 +293,6 @@ def apply_compiled_transforms(
                     moved_nodes = _detach_children_for_hoist(node, name)
                     if moved_nodes:
                         for child in moved_nodes:
-                            _mark_start(child, transform_index)
                             child.parent = parent
                         children[child_index : child_index + 1] = moved_nodes
                     else:
@@ -865,7 +863,6 @@ def apply_compiled_transforms(
 
                         if moved_nodes_unwrap:
                             for child in moved_nodes_unwrap:
-                                _mark_start(child, idx + 1)
                                 child.parent = parent
                             children[i : i + 1] = moved_nodes_unwrap
                         else:

{justhtml-3.11.2 → justhtml-3.11.3}/tests/test_parser_engine.py

@@ -1745,7 +1745,7 @@ class TestParserAttributeProjection(_ParserEngineTestCase):
         )
         self.assert_parses_to(
             "<tr selected> <svg href=x><table href=x></table><math a=1> </svg>\n</tr></math>\n<blockquote a=1>",
-            "<tbody><tr> </tr></tbody><table></table> \n\n<blockquote></blockquote>",
+            "<tbody><tr> </tr></tbody><table></table>\n<blockquote></blockquote>",
             fragment_context=FragmentContext("table"),
         )
         self.assert_parses_to(

{justhtml-3.11.2 → justhtml-3.11.3}/tests/test_sanitize_integration.py

@@ -8,6 +8,7 @@ from typing import Any
 from justhtml import DEFAULT_POLICY, JustHTML
 from justhtml.parser.context import FragmentContext
 from justhtml.sanitizer import SanitizationPolicy, UrlPolicy, UrlProxy, UrlRule
+from justhtml.transforms import Sanitize
 
 _CASES_DIR = Path(__file__).with_name("justhtml-sanitize-tests")
 
@@ -89,6 +90,16 @@ def _build_policy(spec: Any) -> SanitizationPolicy:
 
 
 class TestSanitizeIntegration(unittest.TestCase):
+    def test_foreign_subtree_under_disallowed_parent_is_dropped(self) -> None:
+        for html in (
+            "<table><tr><td><select><math><mi>unsafe</mi><p>safe</table>",
+            "<template><svg><foo><template><foreignObject><div></template><div>",
+        ):
+            fused = JustHTML(html).to_html(pretty=False)
+            explicit = JustHTML(html, transforms=[Sanitize()]).to_html(pretty=False)
+            assert fused == explicit
+            assert "unsafe" not in fused
+
     def test_sanitize_cases(self) -> None:
         cases_path = _CASES_DIR / "cases.json"
         cases = json.loads(cases_path.read_text(encoding="utf-8"))

{justhtml-3.11.2 → justhtml-3.11.3}/tests/test_transforms.py

@@ -208,6 +208,29 @@ class TestTransforms(unittest.TestCase):
         doc = JustHTML("<p>Hello <span>world</span></p>", transforms=[Unwrap("span")])
         assert doc.to_html(pretty=False) == "<html><head></head><body><p>Hello world</p></body></html>"
 
+    def test_hoisted_children_receive_earlier_transforms(self) -> None:
+        for structural_transform in (Unwrap("p, span"), Escape("p, span")):
+            doc = JustHTML(
+                "<p><span><a href='https://eff.org'>EFF</a></span></p>",
+                fragment=True,
+                transforms=[SetAttrs("a", rel="noopener"), structural_transform],
+            )
+            assert '<a href="https://eff.org" rel="noopener">EFF</a>' in doc.to_html(pretty=False)
+
+    def test_sanitize_hoisted_children_receive_earlier_transforms(self) -> None:
+        policy = SanitizationPolicy(
+            allowed_tags={"a"},
+            allowed_attributes={"a": {"href", "rel"}},
+            url_policy=UrlPolicy(allow_rules={("a", "href"): UrlRule(allowed_schemes={"https"})}),
+        )
+        doc = _JustHTML(
+            '<p><span><a href="https://eff.org">EFF</a></span></p>',
+            fragment=True,
+            transforms=[SetAttrs("a", rel="noopener")],
+            policy=policy,
+        )
+        assert doc.to_html(pretty=False) == '<a href="https://eff.org" rel="noopener">EFF</a>'
+
     def test_unwrap_handles_empty_elements(self) -> None:
         doc = JustHTML("<div><span></span>ok</div>", transforms=[Unwrap("span")])
         assert doc.to_html(pretty=False) == "<html><head></head><body><div>ok</div></body></html>"