Ticket #6526: 6526-markdown-with-safe-options.diff

django/contrib/markup/templatetags/markup.py

@@ -10 +10 @@
 
     * reStructuredText, which requires docutils from http://docutils.sf.net/
 """
+import re
 
 from django import template
 from django.conf import settings
 from django.utils.encoding import smart_bytes, force_text
 from django.utils.safestring import mark_safe
 
+SAFE_MARKDOWN_REGEX = re.compile('^safe(=(?P<mode>replace|remove|escape))?$')
+
 register = template.Library()
 
 @register.filter(is_safe=True)
@@ -40 +43 @@
         {{ value|markdown:"extension1_name,extension2_name..." }}
 
     To enable safe mode, which strips raw HTML and only returns HTML
-    generated by actual Markdown syntax, pass "safe" as the first
-    extension in the list.
+    generated by actual Markdown syntax, pass one of the following:
+
+    "safe=replace" to replace the html
+    "safe=escape"  to escape the html
+    "safe=remove"  to remove the html
 
     If the version of Markdown in use does not support extensions,
     they will be silently ignored.
@@ -62 +68 @@
             return force_text(value)
         else:
             extensions = [e for e in arg.split(",") if e]
-            if extensions and extensions[0] == "safe":
+            if extensions and SAFE_MARKDOWN_REGEX.match(extensions[0]):
+                # Check to see in a safe mode has been selected using a
+                # pre-compiled regex.
+                mode = SAFE_MARKDOWN_REGEX.match(extensions[0]).group('mode')
+                if mode:
+                    safe_mode = mode
+                else:
+                    # Use true for compatablity with older python-markdown libraries.
+                    safe_mode = True
                 extensions = extensions[1:]
                 return mark_safe(markdown.markdown(
-                    force_text(value), extensions, safe_mode=True, enable_attributes=False))
+                    force_text(value), extensions, safe_mode=safe_mode, enable_attributes=False))
             else:
                 return mark_safe(markdown.markdown(
                     force_text(value), extensions, safe_mode=False))

django/contrib/markup/tests.py

@@ -72 +72 @@
         rendered = t.render(Context({'markdown_content':markdown_content})).strip()
         self.assertFalse('@' in rendered)
 
+    @unittest.skipUnless(markdown and markdown_version >= (2,1), 'markdown >= 2.1 not installed')
+    def test_markdown_safe_remove(self):
+        t = Template("{% load markup %}{{ markdown_content|markdown:'safe=remove,' }}")
+        markdown_content = "<code>Some stuff</code>"
+        rendered = t.render(Context({'markdown_content':markdown_content})).strip()
+        self.assertFalse('<code>' in rendered)
+        self.assertFalse('[HTML_REMOVED]' in rendered)
+
+    @unittest.skipUnless(markdown and markdown_version >= (2,1), 'markdown >= 2.1 not installed')
+    def test_markdown_safe_replace(self):
+        t = Template("{% load markup %}{{ markdown_content|markdown:'safe=replace,' }}")
+        markdown_content = "<code>Some stuff</code>"
+        rendered = t.render(Context({'markdown_content':markdown_content})).strip()
+        self.assertFalse('<code>' in rendered)
+        self.assertTrue('[HTML_REMOVED]' in rendered)
+
+    @unittest.skipUnless(markdown and markdown_version >= (2,1), 'markdown >= 2.1 not installed')
+    def test_markdown_safe_escape(self):
+        t = Template("{% load markup %}{{ markdown_content|markdown:'safe=escape,' }}")
+        markdown_content = "<code>Some stuff</code>"
+        rendered = t.render(Context({'markdown_content':markdown_content})).strip()
+        self.assertFalse('<code>' in rendered)
+        self.assertTrue('&lt;code&gt;' in rendered)
+
     @unittest.skipIf(markdown, 'markdown is installed')
     def test_no_markdown(self):
         t = Template("{% load markup %}{{ markdown_content|markdown }}")