keithasaurus / simple_html Goto Github PK

>>> # this is ok
>>> user_input = "red"
>>> div({"class": user_input})
<div class="red"></div>

>>> # this is xss
>>> user_input = '" onmouseenter="alert(1)" noop="'
>>> div({"class": user_input})
<div class="" onmouseenter="alert(1)" noop=""></div>

>>> # this is xss
>>> user_input = 'onmouseenter="alert(1)" noop'
>>> div({user_input: "1"})
<div onmouseenter="alert(1)" noop="1"></div>

>>> # this is ok
>>> user_input = '" onmouseenter="alert(1)" noop="'
>>> div({"class": escape(user_input)})
<div class="&quot; onmouseenter=&quot;alert(1)&quot; noop=&quot;"></div>

>>> # this is ok
>>> user_input = 'onmousenter="alert(1)" noop'
>>> div({escape(user_input): "1"})
<div onmousenter=&quot;alert(1)&quot; noop="1"></div>

>>> # this is more ok?
>>> def escape_attr_key(key: str) -> str:
    return (
        escape(key)
        .replace("=", "=")
        .replace("\\", "\")
        .replace("`", "`")
    )
>>> user_input = 'onmousenter="alert(1)" noop'
>>> div({escape_attr_key(user_input): "1"})
<div onmousenter&#x3D;&quot;alert(1)&quot; noop="1"></div>