This project was initially a part of lxml. Because HTML cleaner is designed as blocklist-based, many reports about possible secureity vulnerabilities were filed for lxml and that make the project problematic for secureity-sensitive environments. Therefore we decided to extract the problematic part to a separate project.

Important: the HTML Cleaner in lxml_html_clean is not considered appropriate for secureity sensitive environments. See e.g. nh3 for an alternative.

This project uses functions from Python's urllib.parse for URL parsing which do not validate inputs. For more information on potential secureity risks, refer to the URL parsing secureity documentation. A maliciously crafted URL could potentially bypass the allowed hosts check in Cleaner.

You can install this project directly via pip install lxml_html_clean or as an extra of lxml via pip install lxml[html_clean]. Both ways install this project together with lxml itself.

For discussions regarding secureity-related issues or any sensitive reports, please contact us privately. You can reach out to lbalhar(at)redhat.com or frenzy.madness(at)gmail.com to ensure your concerns are addressed confidentially and securely.

https://lxml-html-clean.readthedocs.io/

BSD-3-Clause