From 0aee4d0dec0b0293af4d102fb67b5cf71ed91d25 Mon Sep 17 00:00:00 2001
From: YOKOTA Hiroshi <yokota.hgml@gmail.com>
Date: Thu, 25 Sep 2025 19:01:17 +0900
Subject: [PATCH 1/6] <iframe> tag must have closing tag

If closing tag is missing, some undefined behaviors will provides test failure.
---
 tests/test_clean.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/test_clean.py b/tests/test_clean.py
index 11cc102..cfc1171 100644
--- a/tests/test_clean.py
+++ b/tests/test_clean.py
@@ -321,7 +321,7 @@ def test_host_whitelist_slash_type_confusion(self):
         # creates a host_whitelist of the empty string; a malformed triple-slash
         # URL has an "empty host" according to urlsplit, and `"" in ""` passes.
         # So, don't allow user to accidentally pass a string for host_whitelist.
-        html = '<div><iframe src="https:///evil.com/page"></div>'
+        html = '<div><iframe src="https:///evil.com/page"></iframe></div>'
         with self.assertRaises(TypeError) as exc:
             # If this were the intended `("example.com",)` the expected
             # output would be '<div></div>'
@@ -331,20 +331,20 @@ def test_host_whitelist_slash_type_confusion(self):
 
     def test_host_whitelist_valid(self):
         # Frame with valid hostname in src is allowed.
-        html = '<div><iframe src="https://example.com/page"></div>'
+        html = '<div><iframe src="https://example.com/page"></iframe></div>'
         expected = '<div><iframe src="https://example.com/page"></iframe></div>'
         cleaner = Cleaner(frames=False, host_whitelist=["example.com"])
         self.assertEqual(expected, cleaner.clean_html(html))
 
     def test_host_whitelist_invalid(self):
-        html = '<div><iframe src="https://evil.com/page"></div>'
+        html = '<div><iframe src="https://evil.com/page"></iframe></div>'
         expected = '<div></div>'
         cleaner = Cleaner(frames=False, host_whitelist=["example.com"])
         self.assertEqual(expected, cleaner.clean_html(html))
 
     def test_host_whitelist_sneaky_userinfo(self):
         # Regression test: Don't be fooled by hostname and colon in userinfo.
-        html = '<div><iframe src="https://example.com:@evil.com/page"></div>'
+        html = '<div><iframe src="https://example.com:@evil.com/page"></iframe></div>'
         expected = '<div></div>'
         cleaner = Cleaner(frames=False, host_whitelist=["example.com"])
         self.assertEqual(expected, cleaner.clean_html(html))

From 7af4b5150e40d8d989ddb0bd2a5635af11f56302 Mon Sep 17 00:00:00 2001
From: YOKOTA Hiroshi <yokota.hgml@gmail.com>
Date: Mon, 29 Sep 2025 23:05:07 +0900
Subject: [PATCH 2/6] Restore original test code that works without closing tag

---
 tests/test_clean.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test_clean.py b/tests/test_clean.py
index cfc1171..64ad52d 100644
--- a/tests/test_clean.py
+++ b/tests/test_clean.py
@@ -321,7 +321,7 @@ def test_host_whitelist_slash_type_confusion(self):
         # creates a host_whitelist of the empty string; a malformed triple-slash
         # URL has an "empty host" according to urlsplit, and `"" in ""` passes.
         # So, don't allow user to accidentally pass a string for host_whitelist.
-        html = '<div><iframe src="https:///evil.com/page"></iframe></div>'
+        html = '<div><iframe src="https:///evil.com/page"></div>'
         with self.assertRaises(TypeError) as exc:
             # If this were the intended `("example.com",)` the expected
             # output would be '<div></div>'

From 0f705cf4c9e6dcbdf636d12fbdbb540bade6ad0a Mon Sep 17 00:00:00 2001
From: YOKOTA Hiroshi <yokota.hgml@gmail.com>
Date: Tue, 30 Sep 2025 17:38:03 +0900
Subject: [PATCH 3/6] lxml 6 no more drops control characters while parsing
 HTML input

Newer lxml like lxml 6 encodes and keeps control characters
as neutralized form.
It eliminates some evil attempts.

Adds fixup to expected result text to pass doctest.
---
 tests/test_clean.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test_clean.txt b/tests/test_clean.txt
index 0a6dd0b..227935b 100644
--- a/tests/test_clean.txt
+++ b/tests/test_clean.txt
@@ -84,7 +84,7 @@
   <body onload="evil_function()">
     <!-- I am interpreted for EVIL! -->
     <a href="javascript:evil_function()">a link</a>
-    <a href="javascrip%20t%20:evil_function()">a control char link</a>
+    <a href="j%01a%02v%03a%04s%05c%06r%07i%0Ep%20t%20:evil_function()">a control char link</a>
     <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgidGVzdCIpOzwvc2NyaXB0Pg==">data</a>
     <a href="#" onclick="evil_function()">another link</a>
     <p onclick="evil_function()">a paragraph</p>

From d5f935c1c0dd9e81f6615cb1e461d308c131f18a Mon Sep 17 00:00:00 2001
From: YOKOTA Hiroshi <yokota.hgml@gmail.com>
Date: Tue, 30 Sep 2025 19:54:38 +0900
Subject: [PATCH 4/6] lxml 6.0.0 removes support for Python < 3.8

https://github.com/lxml/lxml/blob/lxml-6.0.0/CHANGES.txt#L59
> * Support for Python < 3.8 was removed.

Drop py36 from test target list.
---
 tox.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index 8706ef5..4544ea0 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = py36,py38,py39,py310,py311,py312,py313,mypy
+envlist = py38,py39,py310,py311,py312,py313,mypy
 skipsdist = True
 
 [testenv]

From af5e41b63f89250ce515dc10e6f89a85618b57eb Mon Sep 17 00:00:00 2001
From: YOKOTA Hiroshi <yokota.hgml@gmail.com>
Date: Tue, 30 Sep 2025 20:12:36 +0900
Subject: [PATCH 5/6] Drop py36 from Github workflow

---
 .github/workflows/main.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ec790fe..668c3df 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -23,7 +23,6 @@ jobs:
     strategy:
       matrix:
         tox_env:
-          - py36
           - py38
           - py39
           - py310

From 1f767cd4c5bbe51fb9df708d55fd0ee4d38cfa1a Mon Sep 17 00:00:00 2001
From: YOKOTA Hiroshi <yokota.hgml@gmail.com>
Date: Wed, 1 Oct 2025 21:54:22 +0900
Subject: [PATCH 6/6] Revert "Install build dependencies for Python 3.6"

This reverts commit 13447fd5dd58930a1f1f6d0ab594999ae65bd8d8.
---
 .github/workflows/main.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 668c3df..12aab80 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -19,7 +19,6 @@ jobs:
       uses: fedora-python/tox-github-action@main
       with:
         tox_env: ${{ matrix.tox_env }}
-        dnf_install: gcc libxml2-devel libxslt-devel
     strategy:
       matrix:
         tox_env: