Django/django
11
0
Fork 0
Code Pull Requests Projects Releases Activity

[1.4.x] Added a warning that remove_tags() output shouldn't be considered safe.

Browse Source 
Backport of 7efce77de2 from master
This commit is contained in:
Tim Graham 2014-08-07 09:20:59 -04:00
parent 399052d224
commit 88cb7aa6aa
1 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
docs/ref/templates/builtins.txt
View File

@ -1875,15 +1875,27 @@ Removes a space-separated list of [X]HTML tags from the output.
For example:: For example::
{{ value|removetags:"b span"|safe }} {{ value|removetags:"b span" }}
If ``value`` is ``"<b>Joel</b> <button>is</button> a <span>slug</span>"`` the If ``value`` is ``"<b>Joel</b> <button>is</button> a <span>slug</span>"`` the
output will be ``"Joel <button>is</button> a slug"``. unescaped output will be ``"Joel <button>is</button> a slug"``.
Note that this filter is case-sensitive. Note that this filter is case-sensitive.
If ``value`` is ``"<B>Joel</B> <button>is</button> a <span>slug</span>"`` the If ``value`` is ``"<B>Joel</B> <button>is</button> a <span>slug</span>"`` the
output will be ``"<B>Joel</B> <button>is</button> a slug"``. unescaped output will be ``"<B>Joel</B> <button>is</button> a slug"``.
.. admonition:: No safety guarantee
Note that ``removetags`` doesn't give any guarantee about its output being
HTML safe. In particular, it doesn't work recursively, so an input like
``"<sc<script>ript>alert('XSS')</sc</script>ript>"`` won't be safe even if
you apply ``|removetags:"script"``. So if the input is user provided,
**NEVER** apply the ``safe`` filter to a ``removetags`` output. If you are
looking for something more robust, you can use the ``bleach`` Python
library, notably its `clean`_ method.
.. _clean: http://bleach.readthedocs.org/en/latest/clean.html
.. templatefilter:: rjust .. templatefilter:: rjust
@ -2000,10 +2012,10 @@ output will be ``"Joel is a slug"``.
.. admonition:: No safety guarantee .. admonition:: No safety guarantee
Note that ``striptags`` doesn't give any guarantee about its output being Note that ``striptags`` doesn't give any guarantee about its output being
entirely HTML safe, particularly with non valid HTML input. So **NEVER** HTML safe, particularly with non valid HTML input. So **NEVER** apply the
apply the ``safe`` filter to a ``striptags`` output. ``safe`` filter to a ``striptags`` output. If you are looking for something
If you are looking for something more robust, you can use the ``bleach`` more robust, you can use the ``bleach`` Python library, notably its
Python library, notably its `clean`_ method. `clean`_ method.
.. _clean: http://bleach.readthedocs.org/en/latest/clean.html .. _clean: http://bleach.readthedocs.org/en/latest/clean.html