petl-developers / petl / 43493020630

94%

Build Type

push

github

Committed by web-flow

Commit Message

fix: HTML-escape cell and header text in tohtml()/teehtml() (#798)

What was wrong:

`tohtml()`/`teehtml()` interpolate header and cell text straight into
`<th>%s</th>`/`<td>%s</td>` with no escaping (see #797 for the repro),
so:

- `AT&T` renders as `AT&T` at best (bare `&` is invalid HTML),
- `<b>bold` escapes its own `<td>` and corrupts the table,
- `<script>alert(1)</script>` executes when the file is viewed.

Cell data is *data* — a table renderer's basic contract is that it stays
inside its cells. pandas' `to_html`, `tabulate` and prettytable all
escape by default for this reason.

The fix was applied in `html.escape()` on:

- the header text in `_write_begin` (after `index_header`/`truncate`
processing), and
- the `vrepr()` output of each value in `_write_row` (after `truncate`,
so entities never get cut in half).

Deliberately **not** escaped: the user-supplied *formatting* inputs
(`caption`, `tr_style`, `td_styles`), which stay usable as HTML/CSS —
same split as pandas. The numeric right-alignment style path is
unchanged.

Co-authored-by: Rahul Ranjan <11793455+rahul05ranjan@users.noreply.github.com>

Coverage Stats

29 of 33 new or added lines in 2 files covered. (87.88%)

1 existing line in 1 file now uncovered.

16859 of 17982 relevant lines covered (93.75%)

0.94 hits per line