Secure Python Markdown Library [closed]

Answer 1

reddit uses the discount markdown library now.

Answer 2

The other answers mention Python-Markdown's safe mode but that is now deprecated. The authors of Python-Markdown have been quoted saying:

"safe-mode" was a poor name choice that we continue to use for backward comparability (old code still works with our newer versions). What it really is is a no-markup mode. In other words, it is just a way to disallow raw html and really doesn't guarantee safety.

They now recommend using an HTML sanitizer like Bleach to sanitize the Markdown output. mdx_bleach is a Python-Markdown extension that does just that. Disclaimer: I'm the author of this extension.

Because it uses html5lib to parse document fragments the same way browsers do, Bleach is extremely resilient to unknown attacks, much more so than regular-expression-based sanitizers.

Answer 3

Python-Markdown - the 'standard' one more or less - has a 'safe mode' feature that escapes html tags. That should be enough to counter most all HTML injection attacks.