Comments and HTML sanitization

Marius Gedminas <[email protected]> Sat, 16 May 2009 17:58:09 +0300
Newsgroups gmane.comp.web.pyblosxom.devel
Message-ID <20090516145809.GA9310@platonas>
I'm unhappy by the sanitization applied to the comment text:

  * There seems to be no way to talk about HTML tags in the comments.
    If you type '&lt;pre&gt;', this gets escaped and the produces HTML
    is  &amp;lt;pre&amp;gt;.  If you type '<pre>' this is not escaped
    and leaks into the output directly as '<pre>'.

  * The logic that inserts '<br />' on every newline breaks preformatted
    text.   If I type

    <pre>
      if foo:
          bar()
    </pre>

    that is converted to

    <pre><br />
      if foo:<br />
          bar()<br />
    </pre><br />

    resulting in double-spaced look.

Does the comments plugin have any unit tests?

Would it be possible to hook in some markup processor to avoid the
hassle of fixing this?  I'm not familiar with many markup languages
(except to say ReStructuredText is not friendly to non-programmers), but
Markdown seemed kind of nice.

Marius Gedminas
-- 
I need a word processor on my laptop like I need a Selectric typewriter in my
laptop bag.
        -- Don Marti

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables 
unlimited royalty-free distribution of the report engine 
for externally facing server and web deployment. 
http://p.sf.net/sfu/businessobjects

_______________________________________________
Pyblosxom-devel mailing list
Pyblosxom-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/pyblosxom-devel
signature.asc (application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKDtSBkVdEXeem148RAmumAJ9uT0DnH+M4DeJ1+zoGd8XlveBzYQCfQxOL
HvHPEbjeQCHzqle7OdP5XpE=
=Xb8U
-----END PGP SIGNATURE-----