Sanitizing HTML Output¶

The Python-Markdown library does not sanitize its HTML output. If you are processing Markdown input from an untrusted source, it is your responsibility to ensure that it is properly sanitized. See Markdown and XSS for an overview of some of the dangers and Improper markup sanitization in popular software for notes on best practices to ensure HTML is properly sanitized. With those concerns in mind, some recommendations are provided below to ensure that any input from an untrusted source is properly sanitized.

That said, if you fully trust the source of your input, you may choose to do nothing. Conversely, you may find solutions other than those suggested here. However, you do so at your own risk.

Using JustHTML¶

JustHTML is recommended as a sanitizer on the output of markdown.markdown or Markdown.convert. When you pass HTML output through JustHTML, it is sanitized by default according to a strict allow list policy. The policy can be customized if necessary.

import markdown
from justhtml import JustHTML

html =  markdown.markdown(text)
safe_html = JustHTML(html, fragment=True).to_html()

Using nh3 or bleach¶

If you cannot use JustHTML for some reason, some alternatives include nh3 or bleach¹. However, be aware that these libraries will not be sufficient in themselves and will require customization. Some useful lists of allowed tags and attributes can be found in the bleach-allowlist library, which should work with both nh3 and bleach as nh3 mirrors bleach’s API.

import markdown
import bleach
from bleach_allowlist import markdown_tags, markdown_attrs

html =  markdown.markdown(text)
safe_html = bleach.clean(html, markdown_tags, markdown_attrs)

Sanitizing on the Command Line¶

Both Python-Markdown and JustHTML provide command line interfaces which read from STDIN and write to STDOUT. Therefore, they can be used together to ensure that the output from untrusted input is properly sanitized.

echo "Some **Markdown** text." | python -m markdown | justhtml - --fragment > safe_output.html

For more information on JustHTML’s Command Line Interface, see the documentation. Use the --help option for a list of all available options and arguments to the markdown command.