Merged

Conversation

Attacker can use `https:///evil.com` to make a malformed "hostless" URL
that would have a `netloc == ''` -- which is `in` any string. Strings
are not documented to be allowed in this config variable anyhow, so just
raise a type error if someone passes in a string by accident.
(This is a breaking change for people who didn't follow the documented
types, but shouldn't affect anyone else.)
New test fails on current master.

		safe_attrs = defs.safe_attrs
		add_nofollow = False
		host_whitelist = ()
		host_whitelist = []

Comment on lines +246 to +247

…lity

…ontainers but reject str.

timmc deleted the timmc/typecheck-host-whitelist branch

January 5, 2024 00:04

Labels

None yet