Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Python-Markdown includes features like escaping of raw HTML that are obviously intended to make it safe on untrusted input, and generally speaking Markdown is commonly used for rendering user input, such as right here on SO.
But is this implementation really trustworthy? Has anyone here studied it to decide it’s safe to run on arbitrary input?
I see there is eg Markdown in Django XSS safe and Secure Python Markdown Library but is ‘safe’ mode really safe?
The Python Markdown library appears to be safe as far as anyone knows, if you use it properly. See the link for details about how to use it safely, but the short version is: it is important to use the latest version, to set
safe_mode, and to setenable_attributes=False.Update:
safe_modeis now due to be deprecated, because of the security problems with it. See https://github.com/Python-Markdown/markdown/commit/7db56daedf8a6006222f55eeeab748e7789fba89. Instead, use a separate HTML sanitizer, such as HTML Purifier.