Deprecate html argument from Parsers

The defused XMLParse subclass no longer passes the html argument down
to the XMLParse class. The argument has been deprecated and ignored for
a long time. The DefusedXMLParser still takes a html argument. A
deprecation warning is issued when the argument is False and a TypeError
when it's True.

Fixes: https://github.com/tiran/defusedxml/issues/34
Co-authored-by: Erik Cederstrand <erik@cederstrand.dk>
Signed-off-by: Christian Heimes <christian@python.org>

3 files changed, 36 insertions, 4 deletions

diff --git a/CHANGES.txt b/CHANGES.txt
index 8d6225c..3edecb3 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -8,6 +8,10 @@ defusedxml 0.6.0.dev1
 
 - Test on Python 3.7 stable and 3.8-dev
 - Drop support for Python 3.4
+- No longer pass *html* argument to XMLParse. It has been deprecated and
+  ignored for a long time. The DefusedXMLParser still takes a html argument.
+  A deprecation warning is issued when the argument is False and a TypeError
+  when it's True.
 
 
 defusedxml 0.5.0
diff --git a/defusedxml/ElementTree.py b/defusedxml/ElementTree.py
index 5d5cdf5..b350d8d 100644
--- a/defusedxml/ElementTree.py
+++ b/defusedxml/ElementTree.py
@@ -8,13 +8,13 @@
 from __future__ import print_function, absolute_import
 
 import sys
+import warnings
 from xml.etree.ElementTree import TreeBuilder as _TreeBuilder
 from xml.etree.ElementTree import parse as _parse
 from xml.etree.ElementTree import tostring
 
 from .common import PY3
 
-
 if PY3:
     import importlib
 else:
@@ -58,14 +58,28 @@ def _get_py3_cls():
 if PY3:
     _XMLParser, _iterparse, ParseError = _get_py3_cls()
 
+_sentinel = object()
+
 
 class DefusedXMLParser(_XMLParser):
 
-    def __init__(self, html=0, target=None, encoding=None,
+    def __init__(self, html=_sentinel, target=None, encoding=None,
                  forbid_dtd=False, forbid_entities=True,
                  forbid_external=True):
         # Python 2.x old style class
-        _XMLParser.__init__(self, html, target, encoding)
+        _XMLParser.__init__(self, target=target, encoding=encoding)
+        if html is not _sentinel:
+            # the 'html' argument has been deprecated and ignored in all
+            # supported versions of Python. Python 3.8 finally removed it.
+            if html:
+                raise TypeError("'html=True' is no longer supported.")
+            else:
+                warnings.warn(
+                    "'html' keyword argument is no longer supported. Pass "
+                    "in arguments as keyword arguments.",
+                    category=DeprecationWarning
+                )
+
         self.forbid_dtd = forbid_dtd
         self.forbid_entities = forbid_entities
         self.forbid_external = forbid_external
diff --git a/tests.py b/tests.py
index 145172c..a769ac8 100644
--- a/tests.py
+++ b/tests.py
@@ -1,8 +1,10 @@
 from __future__ import print_function
+
+import io
 import os
 import sys
 import unittest
-import io
+import warnings
 
 from xml.sax.saxutils import XMLGenerator
 from xml.sax import SAXParseException
@@ -30,6 +32,12 @@ except ImportError:
     LXML3 = False
 
 
+warnings.filterwarnings(
+    'error',
+    category=DeprecationWarning,
+    module=r"defusedxml\..*"
+)
+
 HERE = os.path.dirname(os.path.abspath(__file__))
 
 # prevent web access
@@ -186,6 +194,12 @@ class TestDefusedElementTree(BaseTests):
     def iterparse(self, source, **kwargs):
         return list(self.module.iterparse(source, **kwargs))
 
+    def test_html_arg(self):
+        with self.assertRaises(DeprecationWarning):
+            ElementTree.XMLParse(html=0)
+        with self.assertRaises(TypeError):
+            ElementTree.XMLParse(html=1)
+
 
 class TestDefusedcElementTree(TestDefusedElementTree):
     module = cElementTree