Ticket #19237: 19237-parser-6.diff

django/utils/html.py

@@ -16 +16 @@
 from django.utils import six
 from django.utils.text import normalize_newlines
 
-from .html_parser import HTMLParser
+from .html_parser import HTMLParser, HTMLParseError
 
 
 # Configuration for urlize() function.
@@ -136 +136 @@
 def strip_tags(value):
     """Returns the given HTML with all tags stripped."""
     s = MLStripper()
-    s.feed(value)
-    data = s.get_data()
     try:
-        res = s.close()
-    except Exception as e:
-        data += s.rawdata
-    return data
+        s.feed(value)
+        s.close()
+    except HTMLParseError:
+        return value
+    else:
+        return s.get_data()
 strip_tags = allow_lazy(strip_tags)
 
 def remove_tags(html, tags):

docs/ref/utils.txt

@@ -490 +490 @@
 
 Usually you should build up HTML using Django's templates to make use of its
 autoescape mechanism, using the utilities in :mod:`django.utils.safestring`
-where appropriate. This module provides some additional low level utilitiesfor
+where appropriate. This module provides some additional low level utilities for
 escaping HTML.
 
 .. function:: escape(text)
@@ -564 +564 @@
         strip_tags(value)
 
     If ``value`` is ``"<b>Joel</b> <button>is</button> a <span>slug</span>"`` the
-    return value will be ``"Joel is a slug"``.
+    return value will be ``"Joel is a slug"``. Note that ``strip_tags`` might
+    still contain unsafe HTML content, so if you plan to use the result in an
+    HTML context, you should still :func:`~django.utils.http.urlencode` (and
+    optionally :func:`~django.utils.safestring.mark_safe`) the returned value.
+
+    .. versionchanged:: 1.6
+
+        For improved safety, ``strip_tags`` is now parser-based.
 
 .. function:: remove_tags(value, tags)
 

tests/utils_tests/test_html.py

@@ -70 +70 @@
             ('</adf>a', 'a'),
             ('<asdf><asdf>e', 'e'),
             ('hi, <f x', 'hi, <f x'),
+            ('234<235, right?', '234<235, right?'),
+            ('a4<a5 right?', 'a4<a5 right?'),
+            ('b7>b2!', 'b7>b2!'),
             ('</fe', '</fe'),
             ('<x>b<y>', 'b'),
             ('a<p onclick="alert(\'<test>\')">b</p>c', 'abc'),