Exercise 2: A Real, Legitimate SafeString Use Case — Possible Solution
====================================================================

THE FUNCTION
------------------------------
    def render_bio_markdown(raw_text):
        # escape EVERYTHING first, THEN convert **bold** markers on the
        # now-safe text into real <strong> tags -- the only HTML this
        # function can ever produce is <strong>, never anything the raw
        # input itself tried to smuggle in
        escaped = html.escape(raw_text)
        with_bold = re.sub(r'\*\*(.+?)\*\*', r'<strong>\1</strong>', escaped)
        return SafeString(with_bold)

VERIFIED, REAL RESULT
------------------------------
    malicious_bio = "Loves **Python** and <script>alert(1)</script>"
    result = render_bio_markdown(malicious_bio)
    print(result)
    # Loves <strong>Python</strong> and &lt;script&gt;alert(1)&lt;/script&gt;

Rendered through a real VarNode inside "<p>Bio: {{ bio }}</p>":

    render(bio=result)
    # <p>Bio: Loves <strong>Python</strong> and &lt;script&gt;alert(1)&lt;/script&gt;</p>

    render(bio=malicious_bio)   # the SAME raw text, not run through the function
    # <p>Bio: Loves **Python** and &lt;script&gt;alert(1)&lt;/script&gt;</p>

The **Python** marker only becomes a real <strong> tag when the text
has genuinely been through render_bio_markdown() first; the identical
raw text passed straight to the template shows the literal asterisks
untouched, and the <script> tag stays fully inert in BOTH cases.

WHY THIS IS DIFFERENT FROM DISABLING ESCAPING FOR THE WHOLE TEMPLATE
------------------------------
Escaping never actually gets turned off anywhere. html.escape() still
runs on the entire raw string first, closing off <script> and any
other real HTML the input might contain -- only the two characters
that make up an already-escaped **bold** marker get selectively
turned into a single, specific, hardcoded tag afterward. Marking the
whole template (or the whole request) as "safe, don't escape" would
have let the real <script> tag straight through too; this function
only ever grants trust to one narrow markdown pattern, on text that's
already been made safe first.

WHY THIS WORKS AS AN ANSWER
------------------------------
It reuses the exact SafeString/escape() mechanism from the chapter
unchanged, verifies both the malicious and the legitimate part of one
single real input side by side, and contrasts the function's own
output against the same raw text with no transformation applied at
all -- showing concretely that safety was earned narrowly, not
switched off broadly.