Question

I am using Markdown in an app to display a user biography. I want the user to be able to slightly format the biography, so I’m letting them use the TinyMCE editor.

Then, displaying it in the Django Template like this

{% load markup %}

<div id="biography">
    {{ biography|markdown }}
</div>

The problem is, if there is a tag in the biography, it is not being escaped as django does everywhere else. This is the source output from a biography test:

<p><strong>asdfsdafsadf</strong></p> 
<p><strong>sd<em>fdfdsfsd</em></strong><em>sdfsdfsdfdsf</em>sdfsdfsdf</p> 
<p><strong>sdafasdfasdf</strong></p> 

<script>document.location='http://test.com'</script> 

How do I set Markdown to escape these malicious scripts?

Answer 1

According to django.contrib.markup.templatetags.markup.markdown‘s docstrings:

To enable safe mode, which strips raw HTML and only returns HTML
generated by actual Markdown syntax, pass “safe” as the first
extension in the list.

This should work:

{{ biography|markdown:"safe" }}