lxml_html_clean
Motivation
This project was initially a part of lxml. Because HTML cleaner is designed as blocklist-based, many reports about possible security vulnerabilities were filed for lxml and that make the project problematic for security-sensitive environments. Therefore we decided to extract the problematic part to a separate project.
Important: the HTML Cleaner in lxml_html_clean is not considered appropriate for security sensitive environments. See e.g. nh3 for an alternative.
This project uses functions from Python's urllib.parse for URL parsing which do not validate inputs. For more information on potential security risks, refer to the URL parsing security documentation. A maliciously crafted URL could potentially bypass the allowed hosts check in Cleaner.
Installation
You can install this project directly via pip install lxml_html_clean or as an extra of lxml
via pip install lxml[html_clean]. Both ways install this project together with lxml itself.
Security
For discussions regarding security-related issues or any sensitive reports, please contact us privately. You can reach out to lbalhar(at)redhat.com or frenzy.madness(at)gmail.com to ensure your concerns are addressed confidentially and securely.
Documentation
https://lxml-html-clean.readthedocs.io/
License
BSD-3-Clause
2 maintainers
Metadata
2 maintainers
Release files for lxml-html-clean 0.4.6
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| lxml_html_clean-0.4.6.tar.gz | 26.4 kB | Without provenance | Details for lxml_html_clean-0.4.6.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| lxml_html_clean-0.4.6-py3-none-any.whl | Python 3 | none | any | Details for lxml_html_clean-0.4.6-py3-none-any.whl |
Total release size: 41.3 kB
Release files / lxml_html_clean-0.4.6.tar.gz
| Download URL | lxml_html_clean-0.4.6.tar.gz |
|---|---|
| Size | 26.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ea9db067c3053854fd87f8d5a1cf01221dc893b54dbf6019c689052e05c64f22
|
|
BLAKE2b-256 checksum How to use checksums |
ac7e2b7118b28d5bb69dfc4f349e1ca92334cf986601d3c809caa62cfa3bfab6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.14.8
|
Release files / lxml_html_clean-0.4.6-py3-none-any.whl
| Download URL | lxml_html_clean-0.4.6-py3-none-any.whl |
|---|---|
| Size | 15.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
cc037270ba500a65e7235409dcddcae8ef37300f26dea826b61d917bf0236880
|
|
BLAKE2b-256 checksum How to use checksums |
f5364898b5e3951635846ed0e445e042fadf02b7c5e811a9e43da5b3557bc8d2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.14.8
|
Security for lxml-html-clean 0.4.6
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
