Allow Django to escape blog excerpt text in template

apps/blogs/templates/blogs/index.html

@@ -14,7 +14,7 @@ <h2 class="welcome-message">Welcome to the <span class="blog-name">Python Inside
                     <h1 class="call-to-action">{{ latest_entry.title }}</h1>
 
                     <p class="date-posted"><time datetime="{{ latest_entry.pub_date|date:"Y-m-d H:i|s" }}">{{ latest_entry.pub_date }}</time></p>
-                    <p class="excerpt">{{ latest_entry.excerpt|striptags|truncatewords:50|safe }}
+                    <p class="excerpt">{{ latest_entry.excerpt|striptags|truncatewords:50 }}
                     <a class="readmore" href="{{ latest_entry.url }}">Read more</a></p>
                 </div>
 {% endblock header_content %}

apps/blogs/tests/test_views.py

@@ -1,6 +1,7 @@
 from django.core.management import call_command
 from django.test import TestCase
 from django.urls import reverse
+from django.utils import timezone
 
 from apps.blogs.models import BlogEntry, Feed
 from apps.blogs.tests.utils import get_test_rss_path
@@ -23,3 +24,17 @@ def test_blog_home(self):
 
         latest = BlogEntry.objects.latest()
         self.assertEqual(resp.context["latest_entry"], latest)
+
+    def test_blog_home_escapes_excerpt(self):
+        """Excerpt from feed content must be auto-escaped, not marked safe."""
+        feed = Feed.objects.create(name="test", website_url="http://example.org", feed_url="http://example.org/feed")
+        BlogEntry.objects.create(
+            title="Safe Post",
+            summary="<p>&lt;img src=x onerror=alert(1) </p>",
+            pub_date=timezone.now(),
+            url="http://example.org/post",
+            feed=feed,
+        )
+        resp = self.client.get(reverse("blog"))
+        self.assertNotContains(resp, "<img src=x onerror=alert(1)")
+        self.assertContains(resp, "&lt;img src=x onerror=alert(1)")