Strip markup from app_name if instance_name_has_markup = True

[IAL32]

Closes #28888

if webserver.instance_name_has_markup = True, we strip markup from flask_app.config["APP_NAME"], preventing it to show up as a sanitized HTML in the <title> tag.

[uranusjr]

Do we want to also un-escape the value? (for & etc) Maybe it’s better to use an HTML parser for this. Or maybe that’s an overkill. No idea.

[IAL32]

Do we want to also un-escape the value? (for & etc)

Something like https://docs.python.org/3/library/html.html#html.unescape ?

From the docs:

Convert all named and numeric character references (e.g. >, >, >) in the string s to the corresponding Unicode characters. This function uses the rules defined by the HTML 5 standard for both valid and invalid character references, and the list of HTML 5 named character references.

[tirkarthi]

Parsing html with regex can be tricky. Please see this answer https://stackoverflow.com/a/4869782/2610955 and also https://blog.codinghorror.com/parsing-html-the-cthulhu-way/. The question has several options and also discusses handling & . Since beautifulsoup is already a dependency maybe it can be used.

python      
Python 3.10.6 (main, Aug  2 2022, 15:11:28) [GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import bs4
>>> from bs4 import BeautifulSoup
>>> b = BeautifulSoup("<b>Bold Site Title Test</b>")          
>>> b.get_text()
'Bold Site Title Test'

[tirkarthi]

Sorry, I had a devel installation and beautifulsoup is a devel dependency.

[uranusjr]

Yeah that's why I wonder if this would be an overkill. It's not terribly difficult to implement text extraction with html.parser (stdlib) but whether it's worthwhile is still susceptive.

[uranusjr]

Actually it is easier than I thought!

import html.parser

def strip_tags(inp: str) -> str:
    parts: list[str] = []

    class TagStripParser(html.parser.HTMLParser):
        def handle_data(self, d: str) -> None:
            parts.append(d)

    TagStripParser().feed(inp)
    return "".join(parts)

>>> strip_tags("<b>Bold Site <span>Title</span> Test &amp;</b>")
'Bold Site Title Test &'

[IAL32]

Used @uranusjr as suggestion for bc21a02. I really didn't know where to put the method. Is there a better place?

[ashb]

Can we use Markup() class from markupsafe instead?

[IAL32]

Can we use Markup() class from markupsafe instead?

@ashb We can't. Markup only escapes html text, which is already done by Flask (see tests).

The goal of my PR would be to remove HTML tags prior to being escaped by Flask, so it doesn't look ugly.

An alternative would be to have something like instance_title which does not contain any markup, but I imagine that's a whole other config entry that we might not want to have.

[ashb]

The goal of my PR would be to remove HTML tags prior to being escaped by Flask, so it doesn't look ugly.

If you put markup in the attribute and don't want it escaped: don't put markup in the attribute.

Stripping didn't seem worth it when the user can just do it selves.

[ashb]

Oh sorry I see. We have it on title and on the page as the h1

[IAL32]

Exactly, we use the same attribute for both, which makes this a bit tricky

[BasPH]

Isn't striptags() better to use here? Instead of implementing our own...

[uranusjr]

I switched the stripping implementation to use Markupsafe. One less thing to maintain.