escape html characters in clean_markdown #868

tcyrus commented 2026年06月25日 00:38:31 +02:00

The site page for FEP-61cf is currently bugged because of unescaped double quotes.
The YAML issue could be solved with something like yaml.safe_dump, but there's also an HTML issue (mkdocs doesn't escape quotes).
clean_markdown now uses the built-in html.escape() (nh3.escape() escapes too much)

The site page for [FEP-61cf](https://fediverse.codeberg.page/fep/fep/61cf/) is currently bugged because of unescaped double quotes. The YAML issue could be solved with something like `yaml.safe_dump`, but there's also an HTML issue (mkdocs doesn't escape quotes). `clean_markdown` now uses the built-in `html.escape()` (`nh3.escape()` escapes too much)

silverpill commented 2026年06月25日 11:04:47 +02:00

Is it a duplicate of #825 ?

Is it a duplicate of https://codeberg.org/fediverse/fep/pulls/825 ?

tcyrus commented 2026年06月25日 15:49:19 +02:00

Escaping double quotes with a backslash fixes the YAML issue (like the PR that you linked), but the double quotes still need to be escaped before being used as an HTML attribute (<meta name="description" content="...">).

html.escape() fixes both the HTML and YAML double quote issue, while also handling other characters (&, <, >, ') that could cause issues.

if you want to keep the changes minimal, something like this should work as well:

transformed = transformed.replace('"', '"')

Escaping double quotes with a backslash fixes the YAML issue (like the PR that you linked), but the double quotes still need to be escaped before being used as an HTML attribute (`<meta name="description" content="...">)`. `html.escape()` fixes both the HTML and YAML double quote issue, while also handling other characters (`&`, `<`, `>`, `'`) that could cause issues. if you want to keep the changes minimal, something like this should work as well: ```py transformed = transformed.replace('"', '&quot;') ```

silverpill commented 2026年06月25日 16:08:53 +02:00

Thanks for clarification, I agree that switching to html.escape() is a good idea.

I decided to merge #825 first, could you rebase this PR?

Thanks for clarification, I agree that switching to `html.escape()` is a good idea. I decided to merge https://codeberg.org/fediverse/fep/pulls/825 first, could you rebase this PR?