Need help fixing a non-security issue…

[ytrezq]

Before I submit any pull requests on that page, just need help with a question as I’m unable to reproduce the behaviour locally :

Where is the code responsible for escaping the content between 2 not whitelisted/disabled html tags (I also think to the dependencies) ?
So that :

 <title>[test](https://ww.google.fr)</title>

renders :

<title>[test](https://ww.google.fr)</title> However, doing the same locally :

echo "<title><a href="https://www.google.fr">test</a></title>" | ./html-pipeline Sanitization

renders :
test
which means :<a href="https://www.google.fr">test</a>in plain text.

An alternative even trigger contents being escaped twice

<xmp>\<a href="https://www.google.fr">test</a></xmp>

<xmp>test</xmp>

finnally there is the <plaintext> tag

<plaintext></plaintext>

<plaintext></plaintext> which while being stripped makes the whole page after it being escaped.
It even escape the final tag of the paragraph. It also can’t be closed

[jch]

What pipeline and filter are you using?

[ytrezq]

@jch : See the update. That’s why I can’t figure about the bug. Nor I can even figure how the content is escaped between two disabled HTML tags.

[jch]

as I’m unable to reproduce the behaviour locally

What is your server implementation? If you're asking about github.com markup, this library is not tied to the site's implementation and you should contact https://github.com/support

[ytrezq]

@jch : ok, I thought the library version used by github.com was the same as this public one. Sorry…

[jch]

@ytrezq no worries ;) I'm going to close this for now