Django-markdown-deux XSS?

[evi1m0]

[test](javascript:alert(1))

alert(1)

[RicterZ]

The sample of the patch: http://buzz.beebeeto.com/topic/5/

[evi1m0]

[[test](javascript:alert(1))](javascript:alert(1))

Bypass

[RicterZ]

@evi1m0 WTF!

[flsf]

23333333

[phith0n]

??? how to solve

[RicterZ]

It seems that the project is no longer maintained. @phith0n

[phith0n]

I used python-xss-filter to render it again:

@register.filter(name="purifier")
def html_purifier_filter(value):
    parser = XssHtml()
    parser.feed(value)
    parser.close()
    return parser.getHtml()

html_purifier_filter.is_safe = True

Then in template

···
{{ post.content | markdown | purifier }}
···

It is not a long-term solution, but effective.

[raminfp]

Hi @phith0n

please use this : https://github.com/bartTC/django-markup

Thanks,

[phith0n]

@raminfp
e... django-markup used python-markdown, it doesn't seem to support extra 'code-friendly', so anything between underscores will be converted into italic or bold?