From 80f08dbdbc1f9c8b4ed75298955016feb697c4a1 Mon Sep 17 00:00:00 2001 From: Claude Paroz Date: Thu, 20 Mar 2014 16:50:50 +0100 Subject: [1.7.x] Improved strip_tags and clarified documentation The fact that strip_tags cannot guarantee to really strip all non-safe HTML content was not clear enough. Also see: https://www.djangoproject.com/weblog/2014/mar/22/strip-tags-advisory/ Backport of 6ca6c36f82b from master. --- docs/ref/templates/builtins.txt | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'docs/ref/templates') diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt index 7900e5ed70..f77c2812cb 100644 --- a/docs/ref/templates/builtins.txt +++ b/docs/ref/templates/builtins.txt @@ -2050,7 +2050,7 @@ If ``value`` is ``10``, the output will be ``1.000000E+01``. striptags ^^^^^^^^^ -Strips all [X]HTML tags. +Makes all possible efforts to strip all [X]HTML tags. For example:: @@ -2059,6 +2059,16 @@ For example:: If ``value`` is ``"Joel a slug"``, the output will be ``"Joel is a slug"``. +.. admonition:: No safety guarantee + + Note that ``striptags`` doesn't give any guarantee about its output being + entirely HTML safe, particularly with non valid HTML input. So **NEVER** + apply the ``safe`` filter to a ``striptags`` output. + If you are looking for something more robust, you can use the ``bleach`` + Python library, notably its `clean`_ method. + +.. _clean: http://bleach.readthedocs.org/en/latest/clean.html + .. templatefilter:: time time -- cgit v1.3