Ticket #19237: 19237-parser-4.diff

django/utils/html.py

@@ -137 +137 @@
     """Returns the given HTML with all tags stripped."""
     s = MLStripper()
     s.feed(value)
-    data = s.get_data()
-    try:
-        res = s.close()
-    except Exception as e:
-        data += s.rawdata
-    return data
+    return s.get_data()
 strip_tags = allow_lazy(strip_tags)
 
 def remove_tags(html, tags):

docs/ref/utils.txt

@@ -566 +566 @@
     If ``value`` is ``"<b>Joel</b> <button>is</button> a <span>slug</span>"`` the
     return value will be ``"Joel is a slug"``.
 
+    .. versionchanged:: 1.6
+
+        For improved safety, ``strip_tags`` is now parser-based. That means that
+        the fed ``value`` should contain valid HTML. Typically, unmatched tags
+        might result in content disappearing.
+
+
 .. function:: remove_tags(value, tags)
 
     Removes a space-separated list of [X]HTML tag names from the output.

tests/utils_tests/test_html.py

@@ -69 +69 @@
             ('<adf>a', 'a'),
             ('</adf>a', 'a'),
             ('<asdf><asdf>e', 'e'),
-            ('hi, <f x', 'hi, <f x'),
-            ('</fe', '</fe'),
+            ('hi, <f x', 'hi, '),
+            ('</fe', ''),
             ('<x>b<y>', 'b'),
             ('a<p onclick="alert(\'<test>\')">b</p>c', 'abc'),
             ('a<p a >b</p>c', 'abc'),