From 222d0633010e2f37f9fbd2d0559ecc4a5643c738 Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Tue, 18 Aug 2015 10:09:17 -0400 Subject: Refs #23269 -- Removed the removetags template tag and related functions per deprecation timeline. --- docs/ref/templates/builtins.txt | 38 -------------------------------------- 1 file changed, 38 deletions(-) (limited to 'docs/ref/templates') diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt index 9bf22e4740..1623ff357b 100644 --- a/docs/ref/templates/builtins.txt +++ b/docs/ref/templates/builtins.txt @@ -1866,44 +1866,6 @@ For example:: If ``value`` is the list ``['a', 'b', 'c', 'd']``, the output could be ``"b"``. -.. templatefilter:: removetags - -removetags -^^^^^^^^^^ - -.. deprecated:: 1.8 - - ``removetags`` cannot guarantee HTML safe output and has been deprecated due - to security concerns. Consider using `bleach`_ instead. - -.. _bleach: http://bleach.readthedocs.org/en/latest/ - -Removes a space-separated list of [X]HTML tags from the output. - -For example:: - - {{ value|removetags:"b span" }} - -If ``value`` is ``"Joel a slug"`` the -unescaped output will be ``"Joel a slug"``. - -Note that this filter is case-sensitive. - -If ``value`` is ``"Joel a slug"`` the -unescaped output will be ``"Joel a slug"``. - -.. admonition:: No safety guarantee - - Note that ``removetags`` doesn't give any guarantee about its output being - HTML safe. In particular, it doesn't work recursively, so an input like - ``"ript>alert('XSS')ript>"`` won't be safe even if - you apply ``|removetags:"script"``. So if the input is user provided, - **NEVER** apply the ``safe`` filter to a ``removetags`` output. If you are - looking for something more robust, you can use the ``bleach`` Python - library, notably its `clean`_ method. - -.. _clean: http://bleach.readthedocs.org/en/latest/clean.html - .. templatefilter:: rjust rjust -- cgit v1.3