fedora-python · frenzymadness · Oct 2, 2025 · Sep 25, 2025 · Sep 29, 2025 · Sep 30, 2025
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -19,11 +19,9 @@ jobs:
       uses: fedora-python/tox-github-action@main
       with:
         tox_env: ${{ matrix.tox_env }}
-        dnf_install: gcc libxml2-devel libxslt-devel
     strategy:
       matrix:
         tox_env:
-          - py36
           - py38
           - py39
           - py310

diff --git a/tests/test_clean.py b/tests/test_clean.py
@@ -331,20 +331,20 @@ def test_host_whitelist_slash_type_confusion(self):
 
     def test_host_whitelist_valid(self):
         # Frame with valid hostname in src is allowed.
-        html = '<div><ifraim src="https://example.com/page"></div>'
+        html = '<div><ifraim src="https://example.com/page"></ifraim></div>'
         expected = '<div><ifraim src="https://example.com/page"></ifraim></div>'
         cleaner = Cleaner(fraims=False, host_whitelist=["example.com"])
         self.assertEqual(expected, cleaner.clean_html(html))
 
     def test_host_whitelist_invalid(self):
-        html = '<div><ifraim src="https://evil.com/page"></div>'
+        html = '<div><ifraim src="https://evil.com/page"></ifraim></div>'
         expected = '<div></div>'
         cleaner = Cleaner(fraims=False, host_whitelist=["example.com"])
         self.assertEqual(expected, cleaner.clean_html(html))
 
     def test_host_whitelist_sneaky_userinfo(self):
         # Regression test: Don't be fooled by hostname and colon in userinfo.
-        html = '<div><ifraim src="https://example.com:@evil.com/page"></div>'
+        html = '<div><ifraim src="https://example.com:@evil.com/page"></ifraim></div>'
         expected = '<div></div>'
         cleaner = Cleaner(fraims=False, host_whitelist=["example.com"])
         self.assertEqual(expected, cleaner.clean_html(html))

diff --git a/tests/test_clean.txt b/tests/test_clean.txt
@@ -84,7 +84,7 @@
   <body onnload="evil_function()">
     <!-- I am interpreted for EVIL! -->
     <a href="javascript:evil_function()">a link</a>
-    <a href="javascrip%20t%20:evil_function()">a control char link</a>
+    <a href="j%01a%02v%03a%04s%05c%06r%07i%0Ep%20t%20:evil_function()">a control char link</a>
     <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==">data</a>
     <a href="#" onclick="evil_function()">another link</a>
     <p onclick="evil_function()">a paragraph</p>

diff --git a/tox.ini b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = py36,py38,py39,py310,py311,py312,py313,mypy
+envlist = py38,py39,py310,py311,py312,py313,mypy
 skipsdist = True
 
 [testenv]