OWASP / OWASP/Nest

strip_markdown() only removes bold, leaving italic/strikethrough/code markers in the plain text output

Open
#4,973 2 comments 0 reactions 1 assignee Claimed by @Shubb07 View on GitHub
Dominant language
Python
Stars
451
Forks
707
Avg merge
22h 59m
Merged PRs (30d)
91

Description

**Describe the bug**

`strip_markdown()` in `backend/apps/slack/utils/format.py` is meant to remove Slack markdown when building the plain text version of a message, but it only handles bold (`*`) and links. Italic (`_`), strikethrough (`~`) and inline code (`` ` ``) are left as-is, so those characters end up in the plain text output instead of being stripped.

```python
def strip_markdown(text: str) -> str:
slack_link_pattern = re.compile(r"<(https?://[^|]+)\|([^>]+)>")
return slack_link_pattern.sub(r"\2 (\1)", text).replace("*", "")
```

**To Reproduce**

Steps to reproduce the behavior:

1. Open a Django shell: `make django-shell`
2. Run:

```python
from apps.slack.utils.format import strip_markdown

strip_markdown("*bold*") # 'bold' -> fine
strip_markdown("_italic_") # '_italic_' -> markers left in
strip_markdown("~strike~") # '~strike~' -> markers left in
strip_markdown("`code`") # '`code`' -> markers left in
```

3. Only bold is stripped; the other formatting markers come back untouched.

**Expected behavior**

All Slack formatting markers should be removed the same way bold already is, so `_italic_` becomes `italic`, `~strike~` becomes `strike`, and `` `code` `` becomes `code`.

**Are you going to work on fixing this?**

- [x] Yes
- [ ] No

**Additional context**

The existing tests in `backend/tests/unit/apps/slack/utils_test.py` only cover links and bold, so this gap isn't caught right now. I'd extend the function to strip the remaining markers and add test cases for italic, strikethrough and inline code.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.