티스토리 수익 글 보기

티스토리 수익 글 보기

Bug #2136144 “ARIA attributes should be considered safe” : Bugs : lxml

ARIA attributes should be considered safe

Bug #2136144 reported by oomsveta
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
lxml
Confirmed
Low
Unassigned

Bug Description

Note: Although lxml.html.clean is no longer part of lxml, defs.safe_attrs, which is involved with the problem, still seems to be in lxml.

## The issue
Currently, lxml.html.clean.Cleaner strips all aria-* attributes (e.g., aria-label, aria-hidden, aria-describedby) and the role attribute by default.

This behavior causes sanitized HTML to lose semantic meaning for assistive technologies (screen readers), making the output non-compliant with WCAG standards.

## Reproduction
“`py
from lxml.html.clean import Cleaner

cleaner = Cleaner() # Default settings
html_input = '<div role="alert" aria-live="assertive">Error message</div>'

# Current Behavior:
# Output: <div>Error message</div>
print(cleaner.clean_html(html_input))

# Desired Behavior:
# Output: <div role="alert" aria-live="assertive">Error message</div>
“`

## Fix

I have prepared a patch that adds ARIA attributes to the default allowed attributes list: https://github.com/oomsveta/lxml/commit/7994d4e61efad9a81fc8c32af8c33001bdf93424

This change ensures that developers using lxml for sanitization do not accidentally strip accessibility features while maintaining protection against XSS.

## — PLEASE PROVIDE THE FOLLOWING INFORMATION: —
Python : sys.version_info(major=3, minor=13, micro=5, releaselevel='final', serial=0)
lxml.etree : (5, 2, 1, 0)
libxml used : (2, 9, 14)
libxml compiled : (2, 9, 14)
libxslt used : (1, 1, 35)
libxslt compiled : (1, 1, 35)

Revision history for this message
scoder (scoder) wrote :

Your change looks good to me, with one little comment that I wrote over there, regarding end of list formatting to keep a nicer diff on further extension.

Could you send a PR for it?

Changed in lxml:
importance: Undecided → Low
milestone: none → 7.0
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.