Python-Markdown - 或多或少的“标准” - 有一个“安全” mode' 功能可转义 html 标签。这应该足以对抗大多数 HTML 注入攻击。
Python-Markdown - the 'standard' one more or less - has a 'safe mode' feature that escapes html tags. That should be enough to counter most all HTML injection attacks.
The other answers mention Python-Markdown's safe mode but that is now deprecated. The authors of Python-Markdown have been quoted saying:
"safe-mode" was a poor name choice that we continue to use for backward comparability (old code still works with our newer versions). What it really is is a no-markup mode. In other words, it is just a way to disallow raw html and really doesn't guarantee safety.
They now recommend using an HTML sanitizer like Bleach to sanitize the Markdown output. mdx_bleach is a Python-Markdown extension that does just that. Disclaimer: I'm the author of this extension.
Because it uses html5lib to parse document fragments the same way browsers do, Bleach is extremely resilient to unknown attacks, much more so than regular-expression-based sanitizers.
发布评论
评论（3）
reddit 现在使用折扣降价库。
reddit uses the discount markdown library now.
Python-Markdown - 或多或少的“标准” - 有一个“安全” mode' 功能可转义 html 标签。这应该足以对抗大多数 HTML 注入攻击。
Python-Markdown - the 'standard' one more or less - has a 'safe mode' feature that escapes html tags. That should be enough to counter most all HTML injection attacks.
其他答案提到了 Python-Markdown 的安全模式，但现已弃用。 Python-Markdown 的作者曾被引用说：
他们现在建议使用 HTML 清理程序（如 Bleach）来清理 Markdown 输出。 mdx_bleach 是一个 Python-Markdown 扩展，它可以做到这一点。免责声明：我是此扩展的作者。
由于 Bleach 与浏览器一样使用 html5lib 来解析文档片段，因此对未知攻击具有极强的弹性，比基于正则表达式的清理程序要强得多。
The other answers mention Python-Markdown's safe mode but that is now deprecated. The authors of Python-Markdown have been quoted saying:
They now recommend using an HTML sanitizer like Bleach to sanitize the Markdown output. mdx_bleach is a Python-Markdown extension that does just that. Disclaimer: I'm the author of this extension.
Because it uses html5lib to parse document fragments the same way browsers do, Bleach is extremely resilient to unknown attacks, much more so than regular-expression-based sanitizers.