python - Markdown编辑器服务器处理最佳实践
黄舟
黄舟 2017-04-18 09:45:48
0
2
427

在自己的工程中使用了开源的EpicEditor,一种Markdown编辑器。但是从Markdown编辑器获取的内容在保持到MySQL数据库之前,应该要做一些过滤动作吧。比如引用第三方资源(JS/CSS/iframe),标签转义,避免SQL注入攻击等。

是否有最佳实践?是否有开源的组件可用?

黄舟
黄舟

人生最曼妙的风景,竟是内心的淡定与从容!

reply all(2)
刘奇

I haven’t found any open source components, but a brief discussion on this issue can be found here. To prevent xss
sql injection, you should use strict input filtering, advanced database connection classes, and ORM to prevent it.

刘奇

I have never used this open source editor. I don’t know whether the content you send to the server is markdown syntax content or markdown-translated html.
For the latter, you can use Bleach to clean html tags
for example:

allowed_tags = ['a', 'p', 'ul', 'li', 'h1']
new_html = bleach.linkify(bleach.clean(u"value html string",tags=allowed_tags, strip=True))

Portal: http://bleach.readthedocs.io/...

Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template