# Sanitizing HTML Output

The Python-Markdown library does not sanitize its HTML output. If you are processing Markdown input from an untrusted source, it is your responsibility to ensure that it is properly sanitized. See Markdown and XSS for an overview of some of the dangers and Improper markup sanitization in popular software for notes on best practices to ensure HTML is properly sanitized. With those concerns in mind, some recommendations are provided below to ensure that any input from an untrusted source is properly sanitized.

That said, if you fully trust the source of your input, you may choose to do nothing. Conversely, you may find solutions other than those suggested here. However, you do so at your own risk.

## Using `JustHTML`

`JustHTML` is recommended as a sanitizer on the output of `markdown.markdown` or `Markdown.convert`. When you pass HTML output through `JustHTML`, it is sanitized by default according to a strict allow list policy. The policy can be customized if necessary.

    import markdown
    from justhtml import JustHTML

    html =  markdown.markdown(text)
    safe_html = JustHTML(html, fragment=True).to_html()

## Using `nh3` or `bleach`

If you cannot use `JustHTML` for some reason, some alternatives include `nh3` or `bleach`1. However, be aware that these libraries will not be sufficient in themselves and will require customization. Some useful lists of allowed tags and attributes can be found in the `bleach-allowlist` library, which should work with both `nh3` and `bleach` as `nh3` mirrors `bleach`’s API.

    import markdown
    import bleach
    from bleach_allowlist import markdown_tags, markdown_attrs

    html =  markdown.markdown(text)
    safe_html = bleach.clean(html, markdown_tags, markdown_attrs)

## Sanitizing on the Command Line

Both Python-Markdown and `JustHTML` provide command line interfaces which read from `STDIN` and write to `STDOUT`. Therefore, they can be used together to ensure that the output from untrusted input is properly sanitized.

    echo "Some **Markdown** text." | python -m markdown | justhtml - --fragment > safe_output.html

For more information on `JustHTML`’s Command Line Interface, see the documentation. Use the `--help` option for a list of all available options and arguments to the `markdown` command.

1. The `bleach` project has been deprecated. However, it may be the only option for some users as `nh3` is a set of Python bindings to a Rust library. ↩