mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 22:26:08 +00:00
Code Issues 32 Releases Wiki Activity

[1.7.x] Added a warning that remove_tags() output shouldn't be considered safe.

Browse Source 
Backport of 7efce77de2 from master
This commit is contained in:
Tim Graham
2014-08-07 09:20:59 -04:00
parent 927d7b8b71
commit 9a51270dba
2 changed files with 28 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/ref/utils.txt
View File

@@ -597,7 +597,8 @@ escaping HTML.
Tries to remove anything that looks like an HTML tag from the string, that
is anything contained within ``<>``.
Absolutely NO guaranty is provided about the resulting string being entirely
Absolutely NO guarantee is provided about the resulting string being
HTML safe. So NEVER mark safe the result of a ``strip_tag`` call without
escaping it first, for example with :func:`~django.utils.html.escape`.
@@ -621,6 +622,13 @@ escaping HTML.
Removes a space-separated list of [X]HTML tag names from the output.
Absolutely NO guarantee is provided about the resulting string being HTML
safe. In particular, it doesn't work recursively, so the output of
``remove_tags("<sc<script>ript>alert('XSS')</sc</script>ript>", "script")``
won't remove the "nested" script tags. So if the ``value`` is untrusted,
NEVER mark safe the result of a ``remove_tags()`` call without escaping it
first, for example with :func:`~django.utils.html.escape`.
For example::
remove_tags(value, "b span")