marksweb / django-bleach

Bleach is a Python module that takes any HTML input, and returns valid, sanitised HTML that contains only an allowed subset of HTML tags, attributes and styles. django-bleach is a Django app that makes using bleach extremely easy.
MIT License
148 stars 23 forks source link

Make `bleach_linkify` safe #77

Open spenserblack opened 1 year ago

spenserblack commented 1 year ago

Is your feature request related to a problem? Please describe.

Right now, html|bleach is marked as safe, but html|bleach_linkify is an unsafe, raw string.

I guess this is intended behavior given the test linked below, but this seems like strange behavior to me https://github.com/marksweb/django-bleach/blob/aefb860ed68870e5af874bb6184c8402de6227be/django_bleach/tests/test_templatetags.py#L58

Describe the solution you'd like

Just like the bleach template tag, I'd like bleach_linkify to return a safestring, not a raw string.

Describe alternatives you've considered

As the linked test shows, html|bleach_linkify|safe seems to be OK (in my usage I actually had to use html|bleach|bleach_linkify|safe).

Additional context AFAIK bleach does support a way to both sanitize HTML and linkify in one pass. Maybe that's a possibility?