#25401: django.utils.html.strip_tags can insert spurious semicolons
-----------------------------+--------------------
Reporter: jbaldivieso | Owner: nobody
Type: Bug | Status: new
Component: Utilities | Version: 1.8
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-----------------------------+--------------------
In limited circumstances, strip_tags mangles legitimate text, inserting a
semicolon before underscores.
{{{
from django.utils.html import strip_tags
# Good
strip_tags("&first_name")
>>> '&first_name'
# Good
strip_tags("first_name<br>")
>>> u'first_name'
# Bad: semicolon introduced before underscore
strip_tags("&first_name<br>")
>>> u'&first;_name'
}}}
Our use-case is allowing rich emails to be drafted using Markdown;
completely safe Markdown urls with query strings can get mangled with this
bug.
--
Ticket URL: <https://code.djangoproject.com/ticket/25401>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/054.facdb7aa20b11384012b1d70f7a69354%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
