mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

[1.6.x] Improved strip_tags and clarified documentation

Browse Source 
The fact that strip_tags cannot guarantee to really strip all
non-safe HTML content was not clear enough. Also see:
https://www.djangoproject.com/weblog/2014/mar/22/strip-tags-advisory/
Backport of 6ca6c36f8 from master.
This commit is contained in:
Claude Paroz
2014-03-20 16:50:50 +01:00
parent c8c2d60614
commit d1503afd66
4 changed files with 53 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/ref/utils.txt
View File

@@ -616,17 +616,23 @@ escaping HTML.
.. function:: strip_tags(value)
Removes anything that looks like an html tag from the string, that is
anything contained within ``<>``.
Tries to remove anything that looks like an HTML tag from the string, that
is anything contained within ``<>``.
Absolutely NO guaranty is provided about the resulting string being entirely
HTML safe. So NEVER mark safe the result of a ``strip_tag`` call without
escaping it first, for example with :func:`~django.utils.html.escape`.
For example::
strip_tags(value)
If ``value`` is ``"<b>Joel</b> <button>is</button> a <span>slug</span>"`` the
return value will be ``"Joel is a slug"``. Note that ``strip_tags`` result
may still contain unsafe HTML content, so you might use
:func:`~django.utils.html.escape` to make it a safe string.
If ``value`` is ``"<b>Joel</b> <button>is</button> a <span>slug</span>"``
the return value will be ``"Joel is a slug"``.
If you are looking for a more robust solution, take a look at the `bleach`_
Python library.
.. _bleach: https://pypi.python.org/pypi/bleach
.. versionchanged:: 1.6