def test_poster_attribute():
 tags = ['video']
 attrs = {'video': ['poster']}
 test = '<video poster="javascript:alert(1)"></video>'
 expect = '<video></video>'
 eq_(expect, clean(test, tags=tags, attributes=attrs))
 ok = '<video poster="/foo.png"></video>'
 eq_(ok, clean(ok, tags=tags, attributes=attrs))

def test_poster_attribute ( ) : tags = [ 'video' ] attrs = { 'video' : [ 'poster' ] } test = '<video poster="javascript:alert(1)"></video>' expect = '<video></video>' eq_ ( expect , clean ( test , tags = tags , attributes = attrs ) ) ok = '<video poster="/foo.png"></video>' eq_ ( ok , clean ( ok , tags = tags , attributes = attrs ) )
poster attributes should not allow javascript .