Skip to content

Instantly share code, notes, and snippets.

@claudep
Created May 22, 2013 19:06
Show Gist options
  • Save claudep/5630059 to your computer and use it in GitHub Desktop.
Save claudep/5630059 to your computer and use it in GitHub Desktop.
diff --git a/django/utils/html.py b/django/utils/html.py
index 5732350..ebf97f8 100644
--- a/django/utils/html.py
+++ b/django/utils/html.py
@@ -137,12 +137,7 @@ def strip_tags(value):
"""Returns the given HTML with all tags stripped."""
s = MLStripper()
s.feed(value)
- data = s.get_data()
- try:
- res = s.close()
- except Exception as e:
- data += s.rawdata
- return data
+ return s.get_data()
strip_tags = allow_lazy(strip_tags)
def remove_tags(html, tags):
diff --git a/docs/ref/utils.txt b/docs/ref/utils.txt
index 14ae9aa..9f8b1f1 100644
--- a/docs/ref/utils.txt
+++ b/docs/ref/utils.txt
@@ -566,6 +566,13 @@ escaping HTML.
If ``value`` is ``"<b>Joel</b> <button>is</button> a <span>slug</span>"`` the
return value will be ``"Joel is a slug"``.
+ .. versionchanged:: 1.6
+
+ For improved safety, ``strip_tags`` is now parser-based. That means that
+ the fed ``value`` should contain valid HTML. Typically, unmatched tags
+ might result in content disappearing.
+
.. function:: remove_tags(value, tags)
Removes a space-separated list of [X]HTML tag names from the output.
diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
index c3e9f7c..d9fbc6d 100644
--- a/tests/utils_tests/test_html.py
+++ b/tests/utils_tests/test_html.py
@@ -69,8 +69,8 @@ class TestUtilsHtml(TestCase):
('<adf>a', 'a'),
('</adf>a', 'a'),
('<asdf><asdf>e', 'e'),
- ('hi, <f x', 'hi, <f x'),
- ('</fe', '</fe'),
+ ('hi, <f x', 'hi, '),
+ ('</fe', ''),
('<x>b<y>', 'b'),
('a<p onclick="alert(\'<test>\')">b</p>c', 'abc'),
('a<p a >b</p>c', 'abc'),
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment