and others added 2 commits
December 17, 2025 10:13Before this commit: `lxml.html.clean.Cleaner` strips all ARIA attributes (e.g., aria-label, aria-hidden, role) by default. This is because they are not included in the "safe attributes" whitelist. This behavior caused sanitized HTML to lose semantic meaning for assistive technologies (screen readers), making the output non-compliant with WCAG standards. After this commit: ARIA attributes are added to `defs.safe_attrs` so the Cleaner will no longer filter them out. This change ensures that developers using lxml for sanitization will not accidentally strip accessibility features while maintaining protection against XSS. Bug report: 2136144
robinwhittleton added a commit to robinwhittleton/lxml that referenced this pull request
Mar 3, 2026This was added in lxml#486, but was already in the set on line 49.
Merged
scoder pushed a commit that referenced this pull request
Mar 27, 2026This was added in #486, but was already in the set on line 49.
scoder pushed a commit that referenced this pull request
Apr 17, 2026Before this commit: `lxml.html.clean.Cleaner` striped all ARIA attributes (e.g., aria-label, aria-hidden, role) by default. This is because they were not included in the "safe attributes" whitelist. This behavior caused sanitized HTML to lose semantic meaning for assistive technologies (screen readers), making the output non-compliant with WCAG standards. After this commit: ARIA attributes are added to `defs.safe_attrs` so the Cleaner will no longer filter them out. This change ensures that developers using lxml for sanitization will not accidentally strip accessibility features while maintaining protection against XSS. Closes https://bugs.launchpad.net/bugs/2136144
scoder pushed a commit that referenced this pull request
Apr 17, 2026This was added in #486, but was already in the set on line 49.
Closed