justhtml 3.11.2__tar.gz → 3.12.0__tar.gz

{justhtml-3.11.2 → justhtml-3.12.0}/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.12.0] - 2026-09-27
+
+### Fixed
+
+- Match HTML5 form recovery in template fragments, including nested and misnested forms.
+- Preserve frameset eligibility when sanitized parsing omits template wrappers from body content.
+
+## [3.11.3] - 2026-09-27
+
+### Fixed
+
+- Apply earlier transforms to allowed children hoisted when sanitization removes a parent (#85).
+- Drop foreign subtrees inside disallowed HTML parents in the default parsing path.
+
 ## [3.11.2] - 2026-08-27
 
 ### Fixed

{justhtml-3.11.2 → justhtml-3.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: justhtml
-Version: 3.11.2
+Version: 3.12.0
 Summary: A pure Python HTML5 parser that just works.
 Project-URL: Homepage, https://github.com/emilstenstrom/justhtml
 Project-URL: Issues, https://github.com/emilstenstrom/justhtml/issues

{justhtml-3.11.2 → justhtml-3.12.0}/docs/linkify.md

@@ -136,6 +136,7 @@ policy = SanitizationPolicy(
     allowed_attributes={"a": ["href"]},
     url_policy=UrlPolicy(allow_rules={("a", "href"): UrlRule(allowed_schemes={"https"})}),
 )
+# An example that uses HTTP, so it should NOT be allowed
 text = "See http://example.com"
 
 # Wrong: Linkify's generated <a href> is created after the sanitize point,
@@ -144,10 +145,10 @@ doc = JustHTML(text, transforms=[Sanitize(policy), Linkify()])
 print(doc.to_html(pretty=False))
 # => See <a href="http://example.com">http://example.com</a>
 
-# Right: Linkify runs first, so its output is covered by the same sanitize pass.
+# Correct: Linkify runs first, so its output is covered by the same sanitize pass.
 doc = JustHTML(text, transforms=[Linkify(), Sanitize(policy)])
 print(doc.to_html(pretty=False))
-# => See http://example.com
+# => See <a>http://example.com</a>
 ```
 
 If you don't need other transforms between them, the simplest safe option is to omit `Sanitize()` entirely and let `sanitize=True` (the default) append it automatically after `Linkify()`.

{justhtml-3.11.2 → justhtml-3.12.0}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "justhtml"
 authors = [{ name = "Emil Stenström", email = "emil@emilstenstrom.se" }]
-version = "3.11.2"
+version = "3.12.0"
 description = "A pure Python HTML5 parser that just works."
 readme = "README.md"
 license = { file = "LICENSE" }

{justhtml-3.11.2 → justhtml-3.12.0}/src/justhtml/parser/engine.py

@@ -1923,6 +1923,11 @@ class ParseEngine:
             self._after_head = False
             self._explicit_head = True
         else:
+            if self._find_open_html_index("body") is not None:
+                # The compiled safe path omits parser-only template wrappers
+                # from the projected tree. Keep their frameset eligibility
+                # effect when they occur in body content.
+                self._frameset_blocked = True
             self._repair_stack_for_start("template")
         self._append_text_boundary(self._current_parent())
         self._stack.append(Element("template", {}, _PARSER_ONLY_NAMESPACE))
@@ -2932,7 +2937,11 @@ class ParseEngine:
             self._close_open_template(tag_start, tag_end)
             self._finish_head_reentry()
             return pos
-        if name == "form" and not self._template_modes:
+        template_fragment = self._fragment_context_name == "template" and self._fragment_context_namespace in {
+            None,
+            "html",
+        }
+        if name == "form" and not self._template_modes and not template_fragment:
             form_node = self._form_element
             self._form_element = None
             if form_node is None:
@@ -3522,6 +3531,15 @@ class ParseEngine:
             elif parent_name != "tr":
                 return pos
 
+        template_fragment = self._fragment_context_name == "template" and self._fragment_context_namespace in {
+            None,
+            "html",
+        }
+        if template_fragment and name == "form":
+            node = self._insert_compiled_safe_element(name, attrs, self_closing, parent)
+            self._nodes_to_unwrap.append(node)
+            return pos
+
         if not action.allowed:
             if action.pre_linefeed:  # pragma: no branch - opposite edge requires invalid parser state
                 self._ignore_lf = True  # pragma: no cover - unreachable after parser-state guards
@@ -3862,8 +3880,12 @@ class ParseEngine:
             )
             return pos
 
+        template_fragment = self._fragment_context_name == "template" and self._fragment_context_namespace in {
+            None,
+            "html",
+        }
         if html_text_parsing and name == "form" and not self._template_modes:
-            if self._form_element is not None:
+            if self._form_element is not None and not template_fragment:
                 return pos
             self._repair_stack_for_start(name)
             node = self._insert_sanitized_element(
@@ -3874,7 +3896,8 @@ class ParseEngine:
                 tag_start=tag_start,
                 tag_end=tag_end,
             )
-            self._form_element = node
+            if not template_fragment:
+                self._form_element = node
             table_idx = self._find_open_index("table")
             in_table_mode = (
                 table_idx is not None
@@ -4212,11 +4235,8 @@ class ParseEngine:
             self._foreign_context_seen = True
             self._nodes_to_unwrap.append(node)
             parent_namespace = getattr(parent, "namespace", None)
-            if parent is self._fragment_context_node or parent_namespace in {None, "html"}:
-                if not self._parser_only_template_depth and (
-                    parent is self._fragment_context_node or parent.name in self._allowed_tags
-                ):
-                    self._nodes_to_drop.append(node)
+            if parent is self._fragment_context_node or parent_namespace in {None, "html", _PARSER_ONLY_NAMESPACE}:
+                self._nodes_to_drop.append(node)
         elif name not in self._allowed_tags:
             self._nodes_to_unwrap.append(node)
         if not is_void:

{justhtml-3.11.2 → justhtml-3.12.0}/src/justhtml/transforms/runtime.py

@@ -231,7 +231,6 @@ def apply_compiled_transforms(
 
                 if moved:
                     for child in moved:
-                        _mark_start(child, mark_new_start_index)
                         child.parent = parent
                     replacement.extend(moved)
 
@@ -294,7 +293,6 @@ def apply_compiled_transforms(
                     moved_nodes = _detach_children_for_hoist(node, name)
                     if moved_nodes:
                         for child in moved_nodes:
-                            _mark_start(child, transform_index)
                             child.parent = parent
                         children[child_index : child_index + 1] = moved_nodes
                     else:
@@ -865,7 +863,6 @@ def apply_compiled_transforms(
 
                         if moved_nodes_unwrap:
                             for child in moved_nodes_unwrap:
-                                _mark_start(child, idx + 1)
                                 child.parent = parent
                             children[i : i + 1] = moved_nodes_unwrap
                         else:

{justhtml-3.11.2 → justhtml-3.12.0}/tests/test_parser_engine.py

@@ -1050,6 +1050,35 @@ class TestParserFragmentsAndTextModes(_ParserEngineTestCase):
             with self.subTest(html=html, context=context):
                 self.assert_parses_to(html, expected, fragment_context=context)
 
+    def test_template_fragment_form_recovery(self) -> None:
+        cases = [
+            ("<form><form>", "<form><form></form></form>", ""),
+            (
+                "<br>BC<form>D<div>E</form>F</div>G",
+                "<br>BC<form>D<div>E</div></form>FG",
+                "<br>BCD<div>E</div>FG",
+            ),
+        ]
+        for html, expected, safe_expected in cases:
+            with self.subTest(html=html):
+                self.assert_parses_to(
+                    html,
+                    expected,
+                    fragment_context=FragmentContext("template"),
+                    sanitize=False,
+                )
+                self.assert_parses_to(
+                    html,
+                    safe_expected,
+                    fragment_context=FragmentContext("template"),
+                )
+
+    def test_disallowed_template_in_body_blocks_frameset_replacement(self) -> None:
+        self.assert_parses_to(
+            "<p><template></template><frameset>",
+            "<html><head></head><body><p></p></body></html>",
+        )
+
     def test_fragment_unwraps_disallowed_template_contents(self) -> None:
         self.assert_parses_to("<template>x</template>", "x", fragment=True)
 
@@ -1745,7 +1774,7 @@ class TestParserAttributeProjection(_ParserEngineTestCase):
         )
         self.assert_parses_to(
             "<tr selected> <svg href=x><table href=x></table><math a=1> </svg>\n</tr></math>\n<blockquote a=1>",
-            "<tbody><tr> </tr></tbody><table></table> \n\n<blockquote></blockquote>",
+            "<tbody><tr> </tr></tbody><table></table>\n<blockquote></blockquote>",
             fragment_context=FragmentContext("table"),
         )
         self.assert_parses_to(

{justhtml-3.11.2 → justhtml-3.12.0}/tests/test_sanitize_integration.py

@@ -8,6 +8,7 @@ from typing import Any
 from justhtml import DEFAULT_POLICY, JustHTML
 from justhtml.parser.context import FragmentContext
 from justhtml.sanitizer import SanitizationPolicy, UrlPolicy, UrlProxy, UrlRule
+from justhtml.transforms import Sanitize
 
 _CASES_DIR = Path(__file__).with_name("justhtml-sanitize-tests")
 
@@ -89,6 +90,16 @@ def _build_policy(spec: Any) -> SanitizationPolicy:
 
 
 class TestSanitizeIntegration(unittest.TestCase):
+    def test_foreign_subtree_under_disallowed_parent_is_dropped(self) -> None:
+        for html in (
+            "<table><tr><td><select><math><mi>unsafe</mi><p>safe</table>",
+            "<template><svg><foo><template><foreignObject><div></template><div>",
+        ):
+            fused = JustHTML(html).to_html(pretty=False)
+            explicit = JustHTML(html, transforms=[Sanitize()]).to_html(pretty=False)
+            assert fused == explicit
+            assert "unsafe" not in fused
+
     def test_sanitize_cases(self) -> None:
         cases_path = _CASES_DIR / "cases.json"
         cases = json.loads(cases_path.read_text(encoding="utf-8"))

{justhtml-3.11.2 → justhtml-3.12.0}/tests/test_transforms.py

@@ -208,6 +208,29 @@ class TestTransforms(unittest.TestCase):
         doc = JustHTML("<p>Hello <span>world</span></p>", transforms=[Unwrap("span")])
         assert doc.to_html(pretty=False) == "<html><head></head><body><p>Hello world</p></body></html>"
 
+    def test_hoisted_children_receive_earlier_transforms(self) -> None:
+        for structural_transform in (Unwrap("p, span"), Escape("p, span")):
+            doc = JustHTML(
+                "<p><span><a href='https://eff.org'>EFF</a></span></p>",
+                fragment=True,
+                transforms=[SetAttrs("a", rel="noopener"), structural_transform],
+            )
+            assert '<a href="https://eff.org" rel="noopener">EFF</a>' in doc.to_html(pretty=False)
+
+    def test_sanitize_hoisted_children_receive_earlier_transforms(self) -> None:
+        policy = SanitizationPolicy(
+            allowed_tags={"a"},
+            allowed_attributes={"a": {"href", "rel"}},
+            url_policy=UrlPolicy(allow_rules={("a", "href"): UrlRule(allowed_schemes={"https"})}),
+        )
+        doc = _JustHTML(
+            '<p><span><a href="https://eff.org">EFF</a></span></p>',
+            fragment=True,
+            transforms=[SetAttrs("a", rel="noopener")],
+            policy=policy,
+        )
+        assert doc.to_html(pretty=False) == '<a href="https://eff.org" rel="noopener">EFF</a>'
+
     def test_unwrap_handles_empty_elements(self) -> None:
         doc = JustHTML("<div><span></span>ok</div>", transforms=[Unwrap("span")])
         assert doc.to_html(pretty=False) == "<html><head></head><body><div>ok</div></body></html>"