Skip to content

Commit

Permalink
Added note for Styler
Browse files Browse the repository at this point in the history
  • Loading branch information
TomAugspurger committed Feb 11, 2024
1 parent 4e40afd commit d0c7047
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 1 deletion.
4 changes: 3 additions & 1 deletion doc/source/user_guide/style.ipynb
Original file line number Diff line number Diff line change
Expand Up @@ -1621,7 +1621,9 @@
"source": [
"### HTML Escaping\n",
"\n",
"Suppose you have to display HTML within HTML, that can be a bit of pain when the renderer can't distinguish. You can use the `escape` formatting option to handle this, and even use it within a formatter that contains HTML itself."
"Suppose you have to display HTML within HTML, that can be a bit of pain when the renderer can't distinguish. You can use the `escape` formatting option to handle this, and even use it within a formatter that contains HTML itself.\n",
"\n",
"Note that if you're using `Styler` on untrusted, user-provided input to serve HTML then you should escape the input to prevent security vulnerabilities. See the Jinja2 documentation for more."
]
},
{
Expand Down
8 changes: 8 additions & 0 deletions pandas/io/formats/style.py
Original file line number Diff line number Diff line change
Expand Up @@ -178,6 +178,14 @@ class Styler(StylerRenderer):
escape : str, optional
Use 'html' to replace the characters ``&``, ``<``, ``>``, ``'``, and ``"``
in cell display string with HTML-safe sequences.
.. warning::
``Styler`` is primarily intended for use on safe input that you control.
When using ``Styler`` on untrusted, user-provided input to serve HTML,
you should set ``escape=true`` to prevent security vulnerabilities.
See the Jinja2 documentation on HTML escaping for more.
Use 'latex' to replace the characters ``&``, ``%``, ``$``, ``#``, ``_``,
``{``, ``}``, ``~``, ``^``, and ``\`` in the cell display string with
LaTeX-safe sequences. Use 'latex-math' to replace the characters
Expand Down

0 comments on commit d0c7047

Please sign in to comment.