oomsveta · GitHub

and others added 2 commits

December 17, 2025 10:13
Before this commit:
`lxml.html.clean.Cleaner` strips all ARIA attributes (e.g., aria-label,
aria-hidden, role) by default. This is because they are not included in
the "safe attributes" whitelist.
This behavior caused sanitized HTML to lose semantic meaning for
assistive technologies (screen readers), making the output non-compliant
with WCAG standards.
After this commit:
ARIA attributes are added to `defs.safe_attrs` so the Cleaner will no
longer filter them out. This change ensures that developers using lxml
for sanitization will not accidentally strip accessibility features
while maintaining protection against XSS.
Bug report: 2136144

@scoder

robinwhittleton added a commit to robinwhittleton/lxml that referenced this pull request

Mar 3, 2026
This was added in lxml#486, but was already in the set on line 49.

Merged

scoder pushed a commit that referenced this pull request

Mar 27, 2026
This was added in #486, but was already in the set on line 49.

scoder pushed a commit that referenced this pull request

Apr 17, 2026
Before this commit:
`lxml.html.clean.Cleaner` striped all ARIA attributes (e.g., aria-label, aria-hidden, role) by default.
This is because they were not included in the "safe attributes" whitelist.
This behavior caused sanitized HTML to lose semantic meaning for assistive technologies
(screen readers), making the output non-compliant with WCAG standards.
After this commit:
ARIA attributes are added to `defs.safe_attrs` so the Cleaner will no longer filter them out.
This change ensures that developers using lxml for sanitization will not accidentally strip
accessibility features while maintaining protection against XSS.
Closes https://bugs.launchpad.net/bugs/2136144

scoder pushed a commit that referenced this pull request

Apr 17, 2026
This was added in #486, but was already in the set on line 49.

Closed

Read the original on github.com ↗