Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Fixed #15365 -- Added a warning to the `contrib.markup` docs remindin…

…g users that the marked up output will not be escaped.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@15673 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit 13838fb233f15ba1a409c31003ca5dc9c9a42eea 1 parent c9db8cc
Gabriel Hurley authored
Showing with 7 additions and 0 deletions.
  1. +7 −0 docs/ref/contrib/markup.txt
7 docs/ref/contrib/markup.txt
View
@@ -24,6 +24,13 @@ To activate these filters, add ``'django.contrib.markup'`` to your
For more documentation, read the source code in
:file:`django/contrib/markup/templatetags/markup.py`.
+.. warning::
+
+ The output of markup filters is marked "safe" and will not be escaped when
+ rendered in a template. Always be careful to sanitize your inputs and make
+ sure you are not leaving yourself vulnerable to cross-site scripting or
+ other types of attacks.
+
.. _Textile: http://en.wikipedia.org/wiki/Textile_%28markup_language%29
.. _Markdown: http://en.wikipedia.org/wiki/Markdown
.. _reST (reStructured Text): http://en.wikipedia.org/wiki/ReStructuredText
Please sign in to comment.
Something went wrong with that request. Please try again.