From 90abadfc39b79986be4d1ea5e620038025955650 Mon Sep 17 00:00:00 2001 From: Yang Jun Date: Mon, 22 Jun 2026 01:55:30 +0800 Subject: [PATCH] docs(strip_html): clarify output is not HTML-safe Reword the warning to note string scanning vs HTML5 parsing, without listing specific bypass cases. Co-authored-by: Cursor --- docs/source/filters/strip_html.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/source/filters/strip_html.md b/docs/source/filters/strip_html.md index 8616f1000..ccb4f581c 100644 --- a/docs/source/filters/strip_html.md +++ b/docs/source/filters/strip_html.md @@ -7,7 +7,7 @@ title: strip_html Removes any HTML tags from a string. {% note warn Not safe for HTML output %} -This filter is **not** a sanitizer. Output may still contain `<` sequences (for example malformed tags without a closing `>`, same as [Shopify Liquid](https://shopify.dev/docs/api/liquid/filters/strip_html)). Do not write the result into HTML without also using [escape][escape], [escape_once][escape_once], or [`outputEscape: "escape"`][outputEscape]. +This filter removes tags by string scanning; it does not parse HTML5 the way a browser does, and it is not a sanitizer. The result may still be unsafe when inserted into HTML. Use [escape][escape], [escape_once][escape_once], or [`outputEscape: "escape"`][outputEscape] for untrusted output. {% endnote %} Input