Skip to content

HTMLParser does not support escapable raw text mode (<textarea> and <title>) #118350

Closed
Closed
HTMLParser does not support escapable raw text mode (<textarea> and <title>)#118350
Assignees
ezio-melotti
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixes3.9 (EOL)end of lifetype-bugAn unexpected behavior, bug, or errortype-securityA security issue

Description

@savchenko
savchenko
opened on Apr 27, 2024

Bug report

Bug description:

An example where parsing stops after the <style color="red">:

from html.parser import HTMLParser
from io import StringIO

class HTML2text(HTMLParser):
    def __init__(self):
        super().__init__()
        self.data = StringIO()
    def handle_data(self, html):
        self.data.write(html)
    def get_data(self):
        return self.data.getvalue().strip()

html_test = '''
<!DOCTYPE html>
<head><title>Glued</title></head><body><some><style color="red">title</bar>
<h1>Spacious             </h1><a href="https://heading.net">heading.net</a>
<span>not<a href="https://www.arpa.home">my.home.arpa</a><p>        URL</p>
</body></html>
'''

parser = HTML2text()
parser.feed(html_test)
print(parser.get_data())

Changing a single character in the word "style" restores the normal functionality.

CPython versions tested on:

3.11

Operating systems tested on:

Linux

Linked PRs

Activity

  1. savchenko
    added
    type-bugAn unexpected behavior, bug, or error
    on Apr 27, 2024

  2. JelleZijlstra commented on Apr 27, 2024

    @JelleZijlstra
    JelleZijlstra
    on Apr 27, 2024
    Member

    Isn't this because you didn't close your <style> tag? If I remember correctly style tags go on until </style> is seen regardless of any other tag-like text within the tag, because they may contain text in other languages.

  3. savchenko commented on Apr 28, 2024

    @savchenko
    savchenko
    on Apr 28, 2024
    Author

    @JelleZijlstra , indeed! Closing <style> allows the snippet to be parsed. However, isn't it inconsistent with the the behaviour observed when parsing other tags?

    For example, this broken HTML is parsed correctly:

    <head><title>Rebelious<h1>Heading<a href="https://example.net">example.net
<span>not<a href="https://www.arpa.home">arpa.home<p>Paragraph<h2>and more

  4. vadmium commented on Apr 28, 2024

    @vadmium
    vadmium
    on Apr 28, 2024
    Member

    The difference is that <style> is a “raw text element”. It cannot contain HTML markup. Most other tags can be followed by other markup. See https://html.spec.whatwg.org/multipage/syntax.html#raw-text-elements

    However I believe your HTML with <title>Rebelious<h1> . . . does trigger a bug. The <title> element is supposed to be an “escapable raw text element”, so <h1> should be counted as part of the raw title text. However it gets parsed as a tag:

    Encountered a start tag: title
    Encountered some data : Rebelious
    Encountered a start tag: h1

  5. ezio-melotti
    self-assigned this
    on Jul 14, 2024

  6. serhiy-storchaka commented on May 7, 2025

    @serhiy-storchaka
    serhiy-storchaka
    on May 7, 2025
    Member

    The original issue (about unclosed <style>) looks like a duplicate of #86155.

  7. serhiy-storchaka
    added this to html.parser issueson Jun 20, 2025
  8. github-project-automation
    moved this to Todo in html.parser issueson Jun 20, 2025
  9. serhiy-storchaka
    changed the title [-]HTMLParser stops parsing upon encountering `<style>` tag[/-] [+]HTMLParser does not support escapable raw text mode (<textarea> and <title>)[/+] on Jul 14, 2025
  10. serhiy-storchaka
    added
    type-securityA security issue
    3.11only security fixes
    3.10 (EOL)end of life
    3.9 (EOL)end of life
    3.12only security fixes
    3.13only security fixes
    on Jul 14, 2025

  11. 11 remaining items

  12. taegyunkim
    added a commit that references this issue on Aug 4, 2025

    pythongh-118350: Fix support of elements "textarea" and "title" in HT…

    7942003
  13. serhiy-storchaka
    added 3 commits that reference this issue on Aug 14, 2025

    [3.11] pythongh-118350: Fix support of elements "textarea" and "title…

    4ca65bc

    [3.10] pythongh-118350: Fix support of elements "textarea" and "title…

    88740cb

    [3.9] pythongh-118350: Fix support of elements "textarea" and "title"…

    eee8b14
  14. serhiy-storchaka
    closed this as completedon Aug 15, 2025
  15. github-project-automation
    moved this from Todo to Done in html.parser issueson Aug 15, 2025
  16. Agent-Hellboy
    added a commit that references this issue on Aug 19, 2025

    pythongh-118350: Fix support of elements "textarea" and "title" in HT…

    8d15be6
  17. kumaraditya303
    added a commit that references this issue on Sep 9, 2025

    [3.14] pythongh-118350: Fix support of elements "textarea" and "title…

    f86baaf
  18. ambv
    added 3 commits that reference this issue on Sep 13, 2025

    [3.9] gh-118350: Fix support of elements "textarea" and "title" in HT…

    4dea0fb

    [3.11] gh-118350: Fix support of elements "textarea" and "title" in H…

    02feb83

    [3.10] gh-118350: Fix support of elements "textarea" and "title" in H…

    9b51801
  19. donbarbos
    added a commit that references this issue on Oct 10, 2025

    [html.parser] Fix stubtest for later patch releases

    dcebffc
  20. mgedmin
    added a commit that references this issue on Oct 20, 2025

    Fix raw markup inside <title> on Python 3.11.14

    71779e6
  21. serhiy-storchaka
    added a parent issue on Oct 31, 2025
  22. NexediGitlab
    added a commit that references this issue on Mar 1, 2026

    ui_test: fix HTML structure in testFolderWorkflowActionWithoutConfirm…

    cc75b70
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixes3.9 (EOL)end of lifetype-bugAn unexpected behavior, bug, or errortype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions