Escape the stylesheet href in calendar.HTMLCalendar.formatyearpage

[augusto-rehfeldt]

Bug report

Bug description:

Documented behaviour: Python calendar documentation, HTMLCalendar.formatyearpage: “css is the name of the cascading style sheet to be used.”

Expected: The parsed stylesheet href is a∉.css; the HTML source should escape its ampersand.

Actual: The parsed stylesheet href is a∉.css.

import calendar
from html.parser import HTMLParser

data = dict(year=2024, width=3, encoding="utf-8", css="a∉.css")

class Links(HTMLParser):
    hrefs = []
    def handle_starttag(self, tag, attrs):
        a = dict(attrs)
        if tag == "link" and a.get("rel") == "stylesheet":
            self.hrefs.append(a.get("href"))

if not (type(data["year"]) is int and 1 <= data["year"] <= 9999
        and isinstance(data["css"], str) and data["css"]
        and data["width"] == 3 and data["encoding"] == "utf-8"):
    print("REFUTATION REJECTED: invalid input")
else:
    parser = Links()
    parser.feed(calendar.HTMLCalendar().formatyearpage(
        data["year"], width=data["width"], encoding=data["encoding"],
        css=data["css"]).decode("utf-8"))
    parser.close()
    expected = data["css"]  # The documented stylesheet name, unchanged.
    if parser.hrefs != [expected]:
        actual = parser.hrefs[0] if len(parser.hrefs) == 1 else parser.hrefs
        print("REFUTATION CONFIRMED:", data, "actual =", repr(actual),
              "expected =", repr(expected))
    else:
        print("REFUTATION REJECTED: parsed href equals the stylesheet name")

Output on Python 3.14.6 (Windows-11-10.0.26220-SP0), standard library calendar:

REFUTATION CONFIRMED: {'year': 2024, 'width': 3, 'encoding': 'utf-8', 'css': 'a∉.css'} actual = 'a∉.css' expected = 'a∉.css'

This report was found and written by an automated property-testing tool I run (bugforge). The reproducer above was executed and its output is pasted unedited; no person reviewed the report before it was filed. The search script is in https://github.com/augusto-rehfeldt/bugforge-results/tree/main/calendar-20261003-014250-c1

CPython versions tested on:

3.14

Operating systems tested on:

Windows

[ZeroIntensity]

See #158748 (comment).