Repository: pypa/readme_renderer (language: python)

Issue:
Escaped HTML visible in package description on pypi.org
(copied from https://github.com/pypi/warehouse/issues/12162, where I got forwarded to this repo)

**Describe the bug**

After publishing the package, there is some escaped HTML visible:

```
<nav class="contents" id="contents">
(table of contens, rendered properly)
</nav>
```

Seeing this with these projects: 

* https://pypi.org/project/zgw-consumers/
* https://pypi.org/project/django-simple-certmanager/

I suspect that something is going wrong with the `contents::`` rst directive, but I can't guarantee this.

**Expected behavior**

No HTML should be visible, instead pypi.org should properly convert the rst into HTML.

**To Reproduce**

* https://pypi.org/project/zgw-consumers/, with readme file: https://github.com/maykinmedia/zgw-consumers/blob/main/README.rst
* https://pypi.org/project/django-simple-certmanager/, with readme file: https://github.com/maykinmedia/django-simple-certmanager/blob/main/README.rst

**My Platform**

* Brave 1.42.88 (Chromium 104.0.5112.81)
* Packages published using the official Github action
* Package built on Github CI with the latest setuptools/wheel that's available (`pip install pip setuptools wheel --upgrade`)

**Additional context**

I cannot reproduce this using any of the `rst2htmlX.py` scripts in my virtualenv.



Discussion / hints:
Thanks for the report! This may have been induced by the recent change from html4 to html5 and the new semantic HTML tag wasn't allowed through our Bleach filter.
We don't currently have a test for this directive, so apologies it was overlooked.

Fix patch:
diff --git a/CHANGES.rst b/CHANGES.rst
index 8ba9f69..a2ee3f9 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -1,6 +1,11 @@
 Changes
 =======
 
+37.1 (2022-09-03)
+-----------------
+
+* Allow HTML5 `nav` tag through cleaner (#259)
+
 37.0 (2022-08-21)
 -----------------
 
diff --git a/readme_renderer/__about__.py b/readme_renderer/__about__.py
index c224c6b..9eca077 100644
--- a/readme_renderer/__about__.py
+++ b/readme_renderer/__about__.py
@@ -29,7 +29,7 @@
 )
 __uri__ = "https://github.com/pypa/readme_renderer"
 
-__version__ = "37.0"
+__version__ = "37.1"
 
 __author__ = "The Python Packaging Authority"
 __email__ = "admin@mail.pypi.org"
diff --git a/readme_renderer/clean.py b/readme_renderer/clean.py
index 9353e1f..747bab8 100644
--- a/readme_renderer/clean.py
+++ b/readme_renderer/clean.py
@@ -30,7 +30,7 @@
     "br", "caption", "cite", "col", "colgroup", "dd", "del", "details", "div",
     "dl", "dt", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "img", "p", "pre",
     "span", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead",
-    "tr", "tt", "kbd", "var", "input", "section", "aside",
+    "tr", "tt", "kbd", "var", "input", "section", "aside", "nav",
 ]
 
 ALLOWED_ATTRIBUTES = {
@@ -63,6 +63,7 @@
     "dl": ["class"],
     "dt": ["class"],
     "ul": ["class"],
+    "nav": ["class"],
 }
 
 


Test patch:
diff --git a/tests/fixtures/test_rst_contents.html b/tests/fixtures/test_rst_contents.html
new file mode 100644
index 0000000..48a5556
--- /dev/null
+++ b/tests/fixtures/test_rst_contents.html
@@ -0,0 +1,22 @@
+<nav class="contents" id="contents">
+<p class="topic-title">Contents</p>
+<ul class="simple">
+<li><p><a href="#features" id="toc-entry-1" rel="nofollow">Features</a></p></li>
+<li><p><a href="#installation" id="toc-entry-2" rel="nofollow">Installation</a></p></li>
+</ul>
+</nav>
+<section id="features">
+<h2><a href="#toc-entry-1" rel="nofollow">Features</a></h2>
+<ul class="simple">
+<li><p>Eats cheese</p></li>
+</ul>
+</section>
+<section id="installation">
+<h2><a href="#toc-entry-2" rel="nofollow">Installation</a></h2>
+<p class="section-subtitle" id="requirements">Requirements</p>
+<ul class="simple">
+<li><p>Teeth</p></li>
+<li><p>Good taste</p></li>
+</ul>
+<p>Let’s eat some cheese together!</p>
+</section>
diff --git a/tests/fixtures/test_rst_contents.rst b/tests/fixtures/test_rst_contents.rst
new file mode 100644
index 0000000..13d77a5
--- /dev/null
+++ b/tests/fixtures/test_rst_contents.rst
@@ -0,0 +1,19 @@
+.. Tests that using a Table of Contents directive renders correctly
+
+.. contents::
+
+Features
+========
+
+* Eats cheese
+
+Installation
+============
+
+Requirements
+------------
+
+* Teeth
+* Good taste
+
+Let's eat some cheese together!