{"action":"created","issue":{"url":"https://api.github.com/repos/OWASP/java-html-sanitizer/issues/96","repository_url":"https://api.github.com/repos/OWASP/java-html-sanitizer","labels_url":"https://api.github.com/repos/OWASP/java-html-sanitizer/issues/96/labels{/name}","comments_url":"https://api.github.com/repos/OWASP/java-html-sanitizer/issues/96/comments","events_url":"https://api.github.com/repos/OWASP/java-html-sanitizer/issues/96/events","html_url":"https://github.com/OWASP/java-html-sanitizer/issues/96","id":180952282,"number":96,"title":"empty `<menuitem>`s misnest","user":{"login":"mikesamuel","id":368886,"avatar_url":"https://avatars2.githubusercontent.com/u/368886?v=3","gravatar_id":"","url":"https://api.github.com/users/mikesamuel","html_url":"https://github.com/mikesamuel","followers_url":"https://api.github.com/users/mikesamuel/followers","following_url":"https://api.github.com/users/mikesamuel/following{/other_user}","gists_url":"https://api.github.com/users/mikesamuel/gists{/gist_id}","starred_url":"https://api.github.com/users/mikesamuel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikesamuel/subscriptions","organizations_url":"https://api.github.com/users/mikesamuel/orgs","repos_url":"https://api.github.com/users/mikesamuel/repos","events_url":"https://api.github.com/users/mikesamuel/events{/privacy}","received_events_url":"https://api.github.com/users/mikesamuel/received_events","type":"User","site_admin":false},"labels":[{"id":526502658,"url":"https://api.github.com/repos/OWASP/java-html-sanitizer/labels/html5","name":"html5","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-10-04T17:15:23Z","updated_at":"2017-04-18T10:39:01Z","closed_at":null,"body":"wynne.jg reports\n\n> Sanitizing\n> \n> ``` html\n> <div contenteditable=\"true\" contextmenu=\"MY_MENU\" dir=\"ltr\" draggable=\"true\" dropzone=\"copy\" hidden=\"\" spellcheck=\"true\" translate=\"yes\">\n>   <menu id=\"MY_MENU\" type=\"context\"> \n>     <menuitem label=\"Refresh\"></menuitem> \n>     <menuitem label=\"Twitter\"></menuitem>\n>   </menu> LOTS OF TEXT HERE\n> </div>\n> ```\n> \n> yields the following\n> \n> ``` html\n> <div contenteditable=\"true\" contextmenu=\"MY_MENU\" dir=\"ltr\" draggable=\"true\" dropzone=\"copy\" hidden=\"\" spellcheck=\"true\" translate=\"yes\"> \n>   <menu id=\"MY_MENU\" type=\"context\">\n>     <menuitem label=\"Refresh\"> <menuitem label=\"Twitter\"></menuitem></menuitem>\n>   </menu> LOTS OF TEXT HERE \n> </div>\n> ```\n\n---\n\nNote the `<menuitem>`s are nesting in the output but are siblings in the input.\n"},"comment":{"url":"https://api.github.com/repos/OWASP/java-html-sanitizer/issues/comments/294774872","html_url":"https://github.com/OWASP/java-html-sanitizer/issues/96#issuecomment-294774872","issue_url":"https://api.github.com/repos/OWASP/java-html-sanitizer/issues/96","id":294774872,"user":{"login":"pickle-weasle","id":13419930,"avatar_url":"https://avatars2.githubusercontent.com/u/13419930?v=3","gravatar_id":"","url":"https://api.github.com/users/pickle-weasle","html_url":"https://github.com/pickle-weasle","followers_url":"https://api.github.com/users/pickle-weasle/followers","following_url":"https://api.github.com/users/pickle-weasle/following{/other_user}","gists_url":"https://api.github.com/users/pickle-weasle/gists{/gist_id}","starred_url":"https://api.github.com/users/pickle-weasle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pickle-weasle/subscriptions","organizations_url":"https://api.github.com/users/pickle-weasle/orgs","repos_url":"https://api.github.com/users/pickle-weasle/repos","events_url":"https://api.github.com/users/pickle-weasle/events{/privacy}","received_events_url":"https://api.github.com/users/pickle-weasle/received_events","type":"User","site_admin":false},"created_at":"2017-04-18T10:39:01Z","updated_at":"2017-04-18T10:39:01Z","body":"A bit more information for this one.\r\nThe tags seem to only get misnested if there is no text between the opening and closing <menuitem> tags.\r\ne.g.\r\n   `<menuitem label=\"Refresh\"></menuitem> \r\n    <menuitem label=\"Twitter\"></menuitem>`\r\nwill be misnested, however\r\n   `<menuitem label=\"Refresh\"> REFRESH</menuitem> \r\n    <menuitem label=\"Twitter\">TWITTER</menuitem>`\r\nwill be nested fine.\r\n\r\nFrom looking at some resources online, this element is aparently [an empty element that has no permited content between it's opening and closing tags](https://developer.mozilla.org/en/docs/Web/HTML/Element/menuitem)\r\nAlso most examples I've found [don't bother having any text between the tags](https://www.w3schools.com/tags/tag_menuitem.asp).\r\nHowever, from playing around with the element it seems that browsers will use the text between the tags as a fallback if there is no label attribute specified.\r\nIdeally it'd be nice if the sanitizer could handle both ways"}}
{"actor":{"display_login":"pickle-weasle"}}