Add support for new html5lib versions

[czpython]

Ref:

#336
#344
#345
#402

[rando305]

Thank you. This is killing me. We need a solution. I can't go to html5lib < .9x9.

I can't edit my production website.

Advise work arounds. I am getting an error:
'module' object has no attribute 'htmlserializer'
Request Method: POST
Request URL: http://localhost:8000/admin/cms/page/edit-plugin/73/
Django Version: 1.9.11
Exception Type: AttributeError
Exception Value:
'module' object has no attribute 'htmlserializer'
Exception Location: C:\Users\rando\Ops3\lib\site-packages\djangocms_text_ckeditor\html.py in clean_html, line 65

[rando305]

Just for those of you who only have 'safe' people using the editor:
Here are two hacks that got my website to stop breaking:
Both are in html.py

1. s.serializer.htmlserializer doesn't exist so replace that line with:
   try:
   s = serializer.htmlserializer.HTMLSerializer(omit_optional_tags=False,
   quote_attr_values=True)
   except AttributeError:
   s = serializer.HTMLSerializer()
   return u''.join(s.serialize(stream))

2. if settings.TEXT_HTML_SANITIZE:
   I inserted a pass afterwards and commented everything out.
   comment out sanitizer from the html5lib import
   comment out: from .sanitizer import TextSanitizer

It might defeat the security features, but at least I can keep my website functional.

[Chronial]

Reposting here, since I never got an answer and would still be interested in working on this:

We would really appreciate if someone has the time to contribute a backwards compatible patch that adds compatibility with the latest html5lib.

@czpython Is it essential that it is backwards compatible? This adds a lot of complexity and the old implementation seems dangerous, since it modifies global settings of html5lib: https://github.com/divio/djangocms-text-ckeditor/blob/6e0b6c2fb48984ee579cc3ca672b5064af1bf10d/djangocms_text_ckeditor/html.py#L23

Or what do you actually mean by backwards compatible?

[merwok]

html5lib <0.99999999 has an XSS vulnerability, so a new release compatible with that version would be very welcome.

[jedie]

ping

[bhrutledge]

This is biting me. Would love to see #464 merged.

[WayneYe]

+1 for this, come on folks :)

[maj0rr]

+1 😀

[jedie]

ping

[MHLut]

bump

[Jamim]

I just sent the following message to the Divio's support through the contact form at http://support.divio.com.

Hello!

There is an issue in Divio's subproject called djangocms-text-ckeditor.
https://github.com/divio/djangocms-text-ckeditor/issues/403
Is someone worknig on resolving this issue?

Best regards,
Aliaksei Urbanski

I'm hoping this will draw their attention to the issue.

Update
I received an answer from Divio's community manager Daniele Procida.

Yes, but I can't give any ETA for resolution, sorry.