| Index: cms/converters.py |
| diff --git a/cms/converters.py b/cms/converters.py |
| index 1e693a8180b88915ba74365320a23a264321b5b7..9d85350e44887be8d668af207f40a2c592dbbfda 100644 |
| --- a/cms/converters.py |
| +++ b/cms/converters.py |
| @@ -181,11 +181,16 @@ class Converter: |
| ) |
| for tag in self.whitelist: |
| + allowed_contents = "(?:[^<>]|%s)" % "|".join(( |
| + "<(?:%s[^<>]*?|/%s)>" % (t, t) |
| + for t in map(re.escape, self.whitelist - {tag}) |
| + )) |
| saved = saved_attributes.get(tag, []) |
| for attrs in saved: |
| attrs = map(stringify_attribute, attrs) |
| result = re.sub( |
| - r"%s([^<>]*?)%s" % (re_escape("<%s>" % tag), re_escape("</%s>" % tag)), |
| + r"%s(%s*?)%s" % (re_escape("<%s>" % tag), allowed_contents, |
| + re_escape("</%s>" % tag)), |
| lambda match: r'<%s%s>%s</%s>' % ( |
| tag, |
| " " + " ".join(attrs) if attrs else "", |
| @@ -195,7 +200,8 @@ class Converter: |
| result, 1, flags=re.S |
| ) |
| result = re.sub( |
| - r"%s([^<>]*?)%s" % (re_escape("<%s>" % tag), re_escape("</%s>" % tag)), |
| + r"%s(%s*?)%s" % (re_escape("<%s>" % tag), allowed_contents, |
| + re_escape("</%s>" % tag)), |
| r"<%s>\1</%s>" % (tag, tag), |
| result, flags=re.S |
| ) |