pythonhtmldjangomarkdownsanitization

How to prevent bleach from escaping > (blockquote) tag used in Markdown


I'm using bleach to sanitize user input. But I use Markdown which means I need the blockquote > symbol to go through without being escaped as & gt; so I can pass it to misaka for rendering.

The documentation says by default it escapes html markup but doesn't say how to turn that off for the > symbol. I would still like it to escape actual html tags.

http://bleach.readthedocs.org/en/latest/clean.html

Any other ideas for sanitizing input while maintaining the ability to use Markdown would be appreciated.


Solution

  • Do you need strip all tags, but leave > as it is?

    1. strip all tags, get output
    2. html decode output of step 1, and pass that data to misaka

    Simple way for step 2:

    output.replace('>', '>')

    More professional

    import HTMLParser
    h = HTMLParser.HTMLParser()
    s = h.unescape(sanitized user input)