Use of calendar input as safe

[agmes4]

While trying to add another calendar to SIPA, I found that we use the 'safe' keyword for the link. This should be validated at some point, otherwise an active member could launch a stored XSS attack. line, also

Solution

I suggest treading the user input as malicious and removing the rendering via passing the url to flask instate of putting Markdown into a cal entry and later converting this to html.
so at the end the safe should be removed