import os
from django.utils import safestring
safestring.mark_safe('<b>secure</b>')
safestring.SafeText('<b>secure</b>')
safestring.SafeUnicode('<b>secure</b>')
safestring.SafeString('<b>secure</b>')
safestring.SafeBytes('<b>secure</b>')
my_secure_str = '<b>Hello World</b>'
safestring.mark_safe(my_secure_str)
my_secure_str, _ = ('<b>Hello World</b>', '')
safestring.mark_safe(my_secure_str)
also_secure_str = my_secure_str
safestring.mark_safe(also_secure_str)
def try_secure():
try:
my_secure_str = 'Secure'
except Exception:
my_secure_str = 'Secure'
else:
my_secure_str = 'Secure'
finally:
my_secure_str = 'Secure'
safestring.mark_safe(my_secure_str)
# -*- coding: utf-8 -*-
import os
from django.utils import safestring
def insecure_function(text, cls=""):
return '<h1 class="{cls}">{text}</h1>'.format(text=text, cls=cls)
my_insecure_str = insecure_function("insecure", cls="\" onload=\"alert('xss')")
safestring.mark_safe(my_insecure_str)
safestring.SafeText(my_insecure_str)
safestring.SafeUnicode(my_insecure_str)
safestring.SafeString(my_insecure_str)
safestring.SafeBytes(my_insecure_str)
def try_insecure(cls="\" onload=\"alert('xss')"):
try:
my_insecure_str = insecure_function("insecure", cls=cls)
except Exception:
my_insecure_str = "Secure"
safestring.mark_safe(my_insecure_str)
def except_insecure(cls="\" onload=\"alert('xss')"):
try:
my_insecure_str = "Secure"
except Exception:
my_insecure_str = insecure_function("insecure", cls=cls)
safestring.mark_safe(my_insecure_str)
# -*- coding: utf-8 -*-
import os
from django.utils import safestring
safestring.mark_safe("<b>secure</b>")
safestring.SafeText("<b>secure</b>")
safestring.SafeUnicode("<b>secure</b>")
safestring.SafeString("<b>secure</b>")
safestring.SafeBytes("<b>secure</b>")
my_secure_str = "<b>Hello World</b>"
safestring.mark_safe(my_secure_str)
my_secure_str, _ = ("<b>Hello World</b>", "")
safestring.mark_safe(my_secure_str)
also_secure_str = my_secure_str
safestring.mark_safe(also_secure_str)
def try_secure():
try:
my_secure_str = "Secure"
except Exception:
my_secure_str = "Secure"
else:
my_secure_str = "Secure"
finally:
my_secure_str = "Secure"
safestring.mark_safe(my_secure_str)