diff options
Diffstat (limited to 'docs/ref')
| -rw-r--r-- | docs/ref/templates/builtins.txt | 12 | ||||
| -rw-r--r-- | docs/ref/utils.txt | 16 |
2 files changed, 22 insertions, 6 deletions
diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt index a73ba87d75..34dd42252a 100644 --- a/docs/ref/templates/builtins.txt +++ b/docs/ref/templates/builtins.txt @@ -1985,7 +1985,7 @@ If ``value`` is ``10``, the output will be ``1.000000E+01``. striptags ^^^^^^^^^ -Strips all [X]HTML tags. +Makes all possible efforts to strip all [X]HTML tags. For example:: @@ -1994,6 +1994,16 @@ For example:: If ``value`` is ``"<b>Joel</b> <button>is</button> a <span>slug</span>"``, the output will be ``"Joel is a slug"``. +.. admonition:: No safety guarantee + + Note that ``striptags`` doesn't give any guarantee about its output being + entirely HTML safe, particularly with non valid HTML input. So **NEVER** + apply the ``safe`` filter to a ``striptags`` output. + If you are looking for something more robust, you can use the ``bleach`` + Python library, notably its `clean`_ method. + +.. _clean: http://bleach.readthedocs.org/en/latest/clean.html + .. templatefilter:: time time diff --git a/docs/ref/utils.txt b/docs/ref/utils.txt index ea6bffce34..5515c01a20 100644 --- a/docs/ref/utils.txt +++ b/docs/ref/utils.txt @@ -595,17 +595,23 @@ escaping HTML. .. function:: strip_tags(value) - Removes anything that looks like an html tag from the string, that is - anything contained within ``<>``. + Tries to remove anything that looks like an HTML tag from the string, that + is anything contained within ``<>``. + Absolutely NO guaranty is provided about the resulting string being entirely + HTML safe. So NEVER mark safe the result of a ``strip_tag`` call without + escaping it first, for example with :func:`~django.utils.html.escape`. For example:: strip_tags(value) If ``value`` is ``"<b>Joel</b> <button>is</button> a <span>slug</span>"`` - the return value will be ``"Joel is a slug"``. Note that ``strip_tags`` - result may still contain unsafe HTML content, so you might use - :func:`~django.utils.html.escape` to make it a safe string. + the return value will be ``"Joel is a slug"``. + + If you are looking for a more robust solution, take a look at the `bleach`_ + Python library. + + .. _bleach: https://pypi.python.org/pypi/bleach .. versionchanged:: 1.6 |