pax_global_header 0000666 0000000 0000000 00000000064 14463323314 0014515 g ustar 00root root 0000000 0000000 52 comment=27308667d6bd63eb5b2c94406d069926d7e40da3
django-bleach-3.1.0/ 0000775 0000000 0000000 00000000000 14463323314 0014174 5 ustar 00root root 0000000 0000000 django-bleach-3.1.0/.editorconfig 0000664 0000000 0000000 00000000376 14463323314 0016657 0 ustar 00root root 0000000 0000000 # http://editorconfig.org
root = true
[*]
charset = utf-8
end_of_line = lf
insert_final_newline = true
trim_trailing_whitespace = true
indent_style = space
indent_size = 4
[*.py]
max_line_length = 80
[*.toml]
indent_size = 2
[*.yml]
indent_size = 2
django-bleach-3.1.0/.github/ 0000775 0000000 0000000 00000000000 14463323314 0015534 5 ustar 00root root 0000000 0000000 django-bleach-3.1.0/.github/ISSUE_TEMPLATE/ 0000775 0000000 0000000 00000000000 14463323314 0017717 5 ustar 00root root 0000000 0000000 django-bleach-3.1.0/.github/ISSUE_TEMPLATE/bug_report.md 0000664 0000000 0000000 00000001027 14463323314 0022411 0 ustar 00root root 0000000 0000000 ---
name: Bug report
about: Create a report to help us improve
title: ''
labels: ''
assignees: ''
---
**Describe the bug**
A clear and concise description of what the bug is.
**To Reproduce**
Steps to reproduce the behavior:
1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error
**Expected behavior**
A clear and concise description of what you expected to happen.
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Additional context**
Add any other context about the problem here.
django-bleach-3.1.0/.github/ISSUE_TEMPLATE/feature_request.md 0000664 0000000 0000000 00000001123 14463323314 0023441 0 ustar 00root root 0000000 0000000 ---
name: Feature request
about: Suggest an idea for this project
title: ''
labels: ''
assignees: ''
---
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
Add any other context or screenshots about the feature request here.
django-bleach-3.1.0/.github/dependabot.yml 0000664 0000000 0000000 00000000457 14463323314 0020372 0 ustar 00root root 0000000 0000000 version: 2
updates:
- package-ecosystem: github-actions
directory: "/"
commit-message:
prefix: "ci:"
include: "scope"
schedule:
interval: weekly
- package-ecosystem: pip
directory: "/"
schedule:
interval: weekly
groups:
python-packages:
patterns:
- "*"
django-bleach-3.1.0/.github/pull_request_template.md 0000664 0000000 0000000 00000000551 14463323314 0022476 0 ustar 00root root 0000000 0000000 # Description
Describe:
* Content of the pull request
* Feature added / Problem fixed
## References
Provide any github issue fixed (as in ``Fix #XYZ``)
# Checklist
* [ ] I have ran `tox` to ensure tests pass
* [ ] Usage documentation added in case of new features
* [ ] README & CHANGELOG updated
* [ ] Tests added / I have not lowered coverage from 100%
django-bleach-3.1.0/.github/workflows/ 0000775 0000000 0000000 00000000000 14463323314 0017571 5 ustar 00root root 0000000 0000000 django-bleach-3.1.0/.github/workflows/codeql-analysis.yml 0000664 0000000 0000000 00000005032 14463323314 0023404 0 ustar 00root root 0000000 0000000 # For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
name: "CodeQL"
on:
push:
branches: [master]
pull_request:
# The branches below must be a subset of the branches above
branches: [master]
schedule:
- cron: '0 18 * * 2'
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
# Override automatic language detection by changing the below list
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
language: ['python']
# Learn more...
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
steps:
- name: Checkout repository
uses: actions/checkout@v3
with:
# We must fetch at least the immediate parents so that if this is
# a pull request then we can checkout the head.
fetch-depth: 2
# If this run was triggered by a pull request event, then checkout
# the head of the pull request instead of the merge commit.
- run: git checkout HEAD^2
if: ${{ github.event_name == 'pull_request' }}
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.
# queries: ./path/to/local/query, your-org/your-repo/queries@main
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@v2
# βΉοΈ Command-line programs to run using the OS shell.
# π https://git.io/JvXDl
# βοΈ If the Autobuild fails above, remove it and uncomment the following three lines
# and modify them (or add more) to build your code if your project
# uses a compiled language
#- run: |
# make bootstrap
# make release
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
django-bleach-3.1.0/.github/workflows/docs.yml 0000664 0000000 0000000 00000001023 14463323314 0021240 0 ustar 00root root 0000000 0000000 name: Docs
on: [push, pull_request]
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
docs:
runs-on: ubuntu-latest
name: docs
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: 3.11
- run: python -m pip install sphinx
- name: Build docs
run: |
cd docs
sphinx-build -W -b html -d _build/doctrees . _build/html
django-bleach-3.1.0/.github/workflows/lint.yml 0000664 0000000 0000000 00000001607 14463323314 0021266 0 ustar 00root root 0000000 0000000 name: Lint
on: [ push, pull_request ]
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
ruff:
name: ruff
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: "3.11"
cache: 'pip'
- run: |
python -m pip install --upgrade pip
pip install ruff
- name: Run Ruff
run: ruff django_bleach
codespell:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: 3.11
cache: 'pip'
- run: python -m pip install codespell
- name: codespell
uses: codespell-project/actions-codespell@master
django-bleach-3.1.0/.github/workflows/publish-to-live-pypi.yml 0000664 0000000 0000000 00000001515 14463323314 0024320 0 ustar 00root root 0000000 0000000 name: Publish Python π distributions π¦ to pypi
on:
release:
types:
- published
jobs:
build-n-publish:
name: Build and publish Python π distributions π¦ to pypi
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Set up Python 3.9
uses: actions/setup-python@v4
with:
python-version: 3.9
- name: Install pypa/build
run: >-
python -m
pip install
build
--user
- name: Build a binary wheel and a source tarball
run: >-
python -m
build
--sdist
--wheel
--outdir dist/
.
- name: Publish distribution π¦ to PyPI
if: startsWith(github.ref, 'refs/tags')
uses: pypa/gh-action-pypi-publish@master
with:
password: ${{ secrets.PYPI_API_TOKEN }}
django-bleach-3.1.0/.github/workflows/publish-to-test-pypi.yml 0000664 0000000 0000000 00000001576 14463323314 0024347 0 ustar 00root root 0000000 0000000 name: Publish Python π distributions π¦ to TestPyPI
on:
push:
branches:
- main
jobs:
build-n-publish:
name: Build and publish Python π distributions π¦ to TestPyPI
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Set up Python 3.9
uses: actions/setup-python@v4
with:
python-version: 3.9
- name: Install pypa/build
run: >-
python -m
pip install
build
--user
- name: Build a binary wheel and a source tarball
run: >-
python -m
build
--sdist
--wheel
--outdir dist/
.
- name: Publish distribution π¦ to Test PyPI
uses: pypa/gh-action-pypi-publish@master
with:
password: ${{ secrets.TEST_PYPI_API_TOKEN }}
repository_url: https://test.pypi.org/legacy/
skip_existing: true
django-bleach-3.1.0/.github/workflows/test.yml 0000664 0000000 0000000 00000005373 14463323314 0021303 0 ustar 00root root 0000000 0000000 name: Tests
on:
push:
branches:
- main
pull_request:
concurrency:
group: ${{ github.head_ref || github.run_id }}
cancel-in-progress: true
jobs:
unit-tests:
name: Python ${{ matrix.python-version }}
runs-on: ubuntu-22.04
strategy:
fail-fast: false
matrix:
python-version:
- 3.8
- 3.9
- '3.10'
- '3.11'
- '3.12'
steps:
- uses: actions/checkout@v3
- uses: actions/setup-python@v4
with:
python-version: ${{ matrix.python-version }}
allow-prereleases: true
cache: pip
cache-dependency-path: 'requirements/*.txt'
- name: Install dependencies
run: |
python -m pip install --upgrade pip setuptools wheel
python -m pip install --upgrade 'tox>=4.0.0rc3'
- name: Run tox targets for ${{ matrix.python-version }}
run: tox run -f py$(echo ${{ matrix.python-version }} | tr -d .)
- name: Upload coverage data
uses: actions/upload-artifact@v3
with:
name: coverage-data
path: '.coverage.*'
coverage:
name: Coverage
runs-on: ubuntu-22.04
needs: unit-tests
steps:
- uses: actions/checkout@v3
- uses: actions/setup-python@v4
with:
python-version: '3.11'
- name: Install dependencies
run: python -m pip install --upgrade coverage[toml]
- name: Download data
uses: actions/download-artifact@v3
with:
name: coverage-data
- name: Fail if coverage is <100%
run: |
python -m coverage combine
python -m coverage html --skip-covered --skip-empty
python -m coverage report --fail-under=100
- name: Upload HTML report
if: ${{ failure() }}
uses: actions/upload-artifact@v3
with:
name: html-report
path: htmlcov
unit-tests-future-versions:
# Runs for all Django/Python versions which are not yet supported
runs-on: ubuntu-22.04
strategy:
fail-fast: false
matrix:
python-version: ['3.11', '3.12']
django-version: [
'https://github.com/django/django/archive/main.tar.gz'
]
steps:
- uses: actions/checkout@v3
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v4
with:
allow-prereleases: true
cache: pip
cache-dependency-path: 'requirements/*.txt'
python-version: ${{ matrix.python-version }}
- name: Install dependencies
run: |
python -m pip install --upgrade pip setuptools wheel
python -m pip install --upgrade 'tox>=4.0.0rc3'
- name: Run tox targets for ${{ matrix.python-version }}
run: tox run -f py$(echo ${{ matrix.python-version }} | tr -d .)
django-bleach-3.1.0/.gitignore 0000664 0000000 0000000 00000002535 14463323314 0016171 0 ustar 00root root 0000000 0000000 # Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class
# C extensions
*.so
# Distribution / packaging
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST
# PyInstaller
# Usually these files are written by a python script from a template
# before PyInstaller builds the exe, so as to inject date/other infos into it.
*.manifest
*.spec
# Installer logs
pip-log.txt
pip-delete-this-directory.txt
# Unit test / coverage reports
htmlcov/
.tox/
.nox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
.hypothesis/
.pytest_cache/
# Translations
*.mo
*.pot
# Django stuff:
*.log
local_settings.py
db.sqlite3
django-bleach.db
# Flask stuff:
instance/
.webassets-cache
# Scrapy stuff:
.scrapy
# Sphinx documentation
docs/_build/
# PyBuilder
target/
# Jupyter Notebook
.ipynb_checkpoints
# IPython
profile_default/
ipython_config.py
# pyenv
.python-version
# celery beat schedule file
celerybeat-schedule
# SageMath parsed files
*.sage.py
# Environments
.env
.venv
env/
venv/
ENV/
env.bak/
venv.bak/
# Spyder project settings
.spyderproject
.spyproject
# Rope project settings
.ropeproject
# mkdocs documentation
/site
# mypy
.mypy_cache/
.dmypy.json
dmypy.json
# Pyre type checker
.pyre/
# IDE
.idea
# OSX
.DS_Store django-bleach-3.1.0/.pep8 0000664 0000000 0000000 00000000070 14463323314 0015046 0 ustar 00root root 0000000 0000000 [flake8]
ignore = E501
exclude = migrations,.venv_*,docs django-bleach-3.1.0/.pre-commit-config.yaml 0000664 0000000 0000000 00000002004 14463323314 0020451 0 ustar 00root root 0000000 0000000 ci:
autofix_commit_msg: |
ci: auto fixes from pre-commit hooks
for more information, see https://pre-commit.ci
autofix_prs: true
autoupdate_commit_msg: 'ci: pre-commit autoupdate'
autoupdate_schedule: monthly
repos:
- repo: https://github.com/asottile/pyupgrade
rev: v3.10.1
hooks:
- id: pyupgrade
args: ["--py38-plus"]
- repo: https://github.com/adamchainz/django-upgrade
rev: '1.14.0'
hooks:
- id: django-upgrade
args: [--target-version, "3.2"]
- repo: https://github.com/charliermarsh/ruff-pre-commit
rev: "v0.0.278"
hooks:
- id: ruff
args: [--fix, --exit-non-zero-on-fix]
- repo: https://github.com/asottile/yesqa
rev: v1.5.0
hooks:
- id: yesqa
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.4.0
hooks:
- id: check-merge-conflict
- id: mixed-line-ending
- repo: https://github.com/ambv/black
rev: 23.7.0
hooks:
- id: black
name: Black
django-bleach-3.1.0/CHANGELOG.md 0000664 0000000 0000000 00000012243 14463323314 0016007 0 ustar 00root root 0000000 0000000 Change Log
==========
This document records all notable changes to [django-bleach](https://github.com/marksweb/django-bleach).
This project adheres to [Semantic Versioning](https://semver.org/).
[unreleased](https://github.com/marksweb/django-bleach/compare/3.1.0...master) changes
-------------------------------------------------------------------------------------
Version 3.1.0
=============
**05-08-2023**
* Added support for django 4.2
* Added support for python 3.12
* Revamp package for easier maintenance
Version 3.0.1
=============
**11-10-2022**
* Added support for django 4.1
Version 3.0.0
=============
**19-05-2022**
* Bleach dependency is now at ``>=5,<6`` [#55](https://github.com/marksweb/django-bleach/pull/55) (Thanks [Laityned](https://github.com/Laityned))
* Deprecate bleach's `allowed_styles` kwarg
* Added support for bleach's `css_sanitizer` kwarg
* Add isort and codespell to ci
* Dropped support for python 3.6 and 3.7 as well as django 3.0 and 3.1
* Renamed default branch from `master` to `main`. If you have the project locally, you can update using:
```shell
git branch -m master main
git fetch origin
git branch -u origin/main main
git remote set-head origin -a
```
Version 2.0.0
=============
###### 08-04-2022
* cap bleach version at ``<5`` [#51](https://github.com/marksweb/django-bleach/issues/51)
* drop support for python 3.6
* drop support for django 3.0 and 3.1
* added support for django 4
Version 1.0.0
=============
###### 13-11-2021
Going to 1.0 is long overdue, especially considering SemVer.
* automated pypi releases via github actions
* pre-commit hooks
* python 3.10 support
* docs syntax highlighting [#38](https://github.com/marksweb/django-bleach/pull/38)
Version 0.9.0
=============
###### 28-09-2021
* Drop support for django <2.2
* Added support for django 4.0
Version 0.8.0
=============
###### 18-09-2021
Thank you to [Mark Gregson](https://github.com/MrkGrgsn) for providing the changes in this release!
* Fix for [#28](https://github.com/marksweb/django-bleach/issues/28): Return ``empty_value`` for any empty input value
* Fix for [#27](https://github.com/marksweb/django-bleach/issues/27): Mark cleaned data as template safe
* Fix for [#25](https://github.com/marksweb/django-bleach/issues/25): Respect the ``form_class`` argument
* Fix custom widget tests [#34](https://github.com/marksweb/django-bleach/pulls/34)
Version 0.7.2
=============
###### 27-07-2021
* Fix for [#23](https://github.com/marksweb/django-bleach/issues/23): `kwargs` being lost in the default form field.
Version 0.7.1
=============
###### 23-07-2021
* Fix for [#21](https://github.com/marksweb/django-bleach/issues/21): default form field not respecting required fields.
Version 0.7.0
=============
###### 09-07-2021
* Default form field set to `forms.BleachField` for `models.BleachField` (Thanks [Alirezaja1384](https://github.com/Alirezaja1384))
* Introduced testing against Python 3.9
Version 0.6.1
=============
###### 07-11-2019
* Handle `None` as an input value of template tags (Thanks [pegler](https://github.com/pegler))
Version 0.6.0
=============
###### 18-10-2019
* Introduced testing against Python 3.8
* Drop support for Django <1.11
* Test coverage at 100%
Version 0.5.3
=============
###### 16-04-2019
* Fix for `BleachField` set to allow `blank` or `null`. (Thanks [denisroldan](https://github.com/denisroldan))
Version 0.5.2
=============
###### 15-03-2019
* Fix for `BleachField` receiving a `None` value. (Thanks [MrkGrgsn](https://github.com/MrkGrgsn))
Version 0.5.1
=============
###### 12-02-2019
* 100% coverage achieved
* Changelog updated with `0.5.0` changes. (Thanks [dyve](https://github.com/dyve))
Version 0.5.0
=============
###### 02-02-2019
* Added support for bleach's `allowed_protocols` kwarg. (Thanks [blag](https://github.com/blag))
* Bleach dependency is now `>=1.5.0`
Version 0.4.1
=============
###### 24-01-2019
* Option to pass *allowed tags* to the `bleach` template filter added by [RafaΕ SelewoΕko](https://github.com/seler).
* Moved project to Github.
Version 0.4.0
=============
###### 18-12-2018
* Added support for django>=1.9
* Ensure that the `model_instance` field gets updated with the clean value
Version 0.3.0
=============
###### 20-09-2014
* The `BleachField` model field now does its own sanitisation,
and does *not* specify a default form field or widget.
Developers are expected to provide their own widget as needed.
Version 0.2.1
=============
###### 02-09-2014
* Make the package python3 compatible.
Version 0.2.0
=============
###### 14-02-2014
* Add `bleach_linkify` template filter from [whitehat2k13](https://bitbucket.org/%7B66836148-7eee-4894-acec-e073b30499ee%7D/)
Version 0.1.5
=============
###### 25-09-2013
Version 0.1.4
=============
###### 03-06-2013
Version 0.1.3
=============
###### 22-08-2012
* Add missing `templatetags` package, by using `find_packages()`
* Correct templatetag name: ``bleach.py`` -> ``bleach_tags.py``
Version 0.1.2
=============
###### 13-08-2012
* Fix south migration bug
Version 0.1.1
=============
###### 13-08-2012
* add south_triple_field for south integration
* clean up files to meet pep8 compliance
Version 0.1.0
=============
###### 13-08-2012
* Initial release
django-bleach-3.1.0/LICENSE 0000664 0000000 0000000 00000002053 14463323314 0015201 0 ustar 00root root 0000000 0000000 MIT License
Copyright (c) 2018 Mark Walker
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE. django-bleach-3.1.0/MANIFEST.in 0000664 0000000 0000000 00000000324 14463323314 0015731 0 ustar 00root root 0000000 0000000 include LICENSE
include README.rst
include CHANGELOG.md
include docs/*.rst
prune docs/_build
graft testproject
global-exclude coverage.xml
global-exclude .coverage
recursive-exclude * *.pyc __pycache__ .DS_Store
django-bleach-3.1.0/README.rst 0000664 0000000 0000000 00000014533 14463323314 0015671 0 ustar 00root root 0000000 0000000 django-bleach - Bleach and sanitise user HTML
=============================================
.. image:: https://readthedocs.org/projects/django-bleach/badge/?version=latest
:target: https://django-bleach.readthedocs.io/en/latest/?badge=latest
:alt: Documentation Status
.. image:: http://img.shields.io/pypi/v/django-bleach.svg?style=flat-square
:target: https://pypi.python.org/pypi/django-bleach/
:alt: Latest Version
.. image:: http://img.shields.io/pypi/l/django-bleach.svg?style=flat-square
:target: https://pypi.python.org/pypi/django-bleach/
:alt: License
.. image:: http://img.shields.io/pypi/dm/django-bleach.svg?style=flat-square
:target: https://pypi.python.org/pypi/django-bleach/
:alt: Downloads
|
.. image:: https://codecov.io/gh/marksweb/django-bleach/branch/master/graph/badge.svg
:target: https://codecov.io/gh/marksweb/django-bleach
.. image:: https://api.codacy.com/project/badge/Grade/c34f923ab0a84a6f96728866c749d511
:alt: Codacy Badge
:target: https://app.codacy.com/app/marksweb/django-bleach?utm_source=github.com&utm_medium=referral&utm_content=marksweb/django-bleach&utm_campaign=Badge_Grade_Dashboard
.. image:: https://results.pre-commit.ci/badge/github/marksweb/django-bleach/master.svg
:target: https://results.pre-commit.ci/latest/github/marksweb/django-bleach/master
:alt: pre-commit.ci status
.. image:: https://img.shields.io/lgtm/grade/python/g/marksweb/django-bleach.svg?logo=lgtm&logoWidth=18
:target: https://lgtm.com/projects/g/marksweb/django-bleach/context:python
:alt: Language grade: Python
.. image:: https://img.shields.io/lgtm/alerts/g/marksweb/django-bleach.svg?logo=lgtm&logoWidth=18
:target: https://lgtm.com/projects/g/marksweb/django-bleach/alerts/
:alt: Total alerts
|
Bleach_ is a Python module that takes any HTML input, and returns
valid, sanitised HTML that contains only an allowed subset of HTML tags,
attributes and styles. ``django-bleach`` is a Django app that makes using
``bleach`` extremely easy.
`Read the documentation here`_.
Setup
-----
1. Install ``django-bleach`` via ``pip``::
pip install django-bleach
2. Add ``django-bleach`` to your ``INSTALLED_APPS``:
.. code-block:: python
INSTALLED_APPS = [
# ...
'django_bleach',
# ...
]
3. Select some sensible defaults for the allowed tags, attributes and styles;
and the behaviour when unknown tags are encountered. Each of these are
optional, and default to using the ``bleach`` defaults. See the
`bleach documentation`_:
.. code-block:: python
# Which HTML tags are allowed
BLEACH_ALLOWED_TAGS = ['p', 'b', 'i', 'u', 'em', 'strong', 'a']
# Which HTML attributes are allowed
BLEACH_ALLOWED_ATTRIBUTES = ['href', 'title', 'style']
# Which CSS properties are allowed in 'style' attributes (assuming
# style is an allowed attribute)
BLEACH_ALLOWED_STYLES = [
'font-family', 'font-weight', 'text-decoration', 'font-variant']
# Strip unknown tags if True, replace with HTML escaped characters if
# False
BLEACH_STRIP_TAGS = True
# Strip comments, or leave them in.
BLEACH_STRIP_COMMENTS = False
4. Select the default widget for bleach fields. This defaults to
``django.forms.Textarea``, but you will probably want to replace it with a
WYSIWYG editor, or something similar:
.. code-block:: python
# Use the CKEditorWidget for bleached HTML fields
BLEACH_DEFAULT_WIDGET = 'wysiwyg.widgets.WysiwygWidget'
I use `django-ckeditor`_ in my projects, but what you use is up to you.
Usage
-----
In your models
**************
``django-bleach`` provides three ways of creating bleached output. The simplest
way of including user-editable HTML content that is automatically sanitised is
by using the ``BleachField`` model field:
.. code-block:: python
# in app/models.py
from django import models
from django_bleach.models import BleachField
class Post(models.Model):
title = models.CharField()
content = BleachField()
# ...
``BleachField`` takes the following arguments, to customise the output of
``bleach``. See the `bleach documentation`_ for their use:
* ``allowed_tags``
* ``allowed_attributes``
* ``strip_tags``
* ``strip_comments``
* ``css_sanitizer``
The following argument will be deprecated in the near future:
* ``allowed_styles``
In addition to the ``bleach``-specific arguments, the ``BleachField`` model field
accepts all of the normal field attributes. Behind the scenes, it is a
``TextField``, and accepts all the same arguments as the default ``TextField`` does.
The ``BleachField`` model field sanitises its value before it is saved to the
database and is marked safe so it can be immediately rendered in a template
without further intervention.
In model forms, ``BleachField`` model field are represented with the
``BleachField`` form field by default.
In your forms
*************
A ``BleachField`` form field is provided. This field sanitises HTML input from
the user, and presents safe, clean HTML to your Django application and the
returned value is marked safe for immediate rendering.
In your templates
*****************
If you have a piece of content from somewhere that needs to be printed in a
template, you can use the ``bleach`` filter:
.. code-block:: django
{% load bleach_tags %}
{{ some_unsafe_content|bleach }}
If filter has no arguments it uses default settings defined in your
application settings. You can override allowed tags by specifying them
as a parameter to the filter:
.. code-block:: django
{{ some_unsafe_content|bleach:"p,span" }}
There is also ``bleach_linkify`` which uses the linkify_ function of bleach
which converts URL-like strings in an HTML fragment to links
This function converts strings that look like URLs, domain names and email
addresses in text that may be an HTML fragment to links, while preserving:
1. links already in the string
2. urls found in attributes
3. email addresses
.. _bleach: https://github.com/mozilla/bleach
.. _Read the documentation here: https://django-bleach.readthedocs.io/
.. _bleach documentation: https://bleach.readthedocs.io/en/latest/clean.html
.. _django-ckeditor: https://github.com/shaunsephton/django-ckeditor
.. _linkify: https://bleach.readthedocs.io/en/latest/linkify.html?highlight=linkify#bleach.linkify "linkify"
django-bleach-3.1.0/django_bleach/ 0000775 0000000 0000000 00000000000 14463323314 0016734 5 ustar 00root root 0000000 0000000 django-bleach-3.1.0/django_bleach/__init__.py 0000664 0000000 0000000 00000000070 14463323314 0021042 0 ustar 00root root 0000000 0000000 __version__ = "3.1.0"
VERSION = __version__.split(".")
django-bleach-3.1.0/django_bleach/forms.py 0000664 0000000 0000000 00000005243 14463323314 0020440 0 ustar 00root root 0000000 0000000 from importlib import import_module
import bleach
from bleach.css_sanitizer import CSSSanitizer
from django import forms
from django.conf import settings
from django.core.exceptions import ImproperlyConfigured
from django.utils.safestring import mark_safe
from django_bleach.utils import get_bleach_default_options
def load_widget(path):
"""Load custom widget for the form field"""
i = path.rfind(".")
module, attr = path[:i], path[i + 1 :]
try:
mod = import_module(module)
except (ImportError, ValueError) as e:
error_message = "Error importing widget for BleachField %s: '%s'"
raise ImproperlyConfigured(error_message % (path, e)) from e
try:
cls = getattr(mod, attr)
except AttributeError as e:
raise ImproperlyConfigured(
f"Module '{module}' does not define a '{attr}' widget"
) from e
return cls
def get_default_widget():
"""Get the default widget or the widget defined in settings"""
default_widget = forms.Textarea
if hasattr(settings, "BLEACH_DEFAULT_WIDGET"):
default_widget = load_widget(settings.BLEACH_DEFAULT_WIDGET)
return default_widget
class BleachField(forms.CharField):
"""Bleach form field"""
empty_values = [None, "", [], (), {}]
def __init__(
self,
allowed_tags=None,
allowed_attributes=None,
allowed_styles=None,
allowed_protocols=None,
strip_comments=None,
strip_tags=None,
css_sanitizer=None,
*args,
**kwargs,
):
self.widget = get_default_widget()
super().__init__(*args, **kwargs)
self.bleach_options = get_bleach_default_options()
if allowed_tags is not None:
self.bleach_options["tags"] = allowed_tags
if allowed_attributes is not None:
self.bleach_options["attributes"] = allowed_attributes
if allowed_styles:
css_sanitizer = CSSSanitizer(allowed_css_properties=allowed_styles)
if css_sanitizer is not None:
self.bleach_options["css_sanitizer"] = css_sanitizer
if allowed_protocols is not None:
self.bleach_options["protocols"] = allowed_protocols
if strip_tags is not None:
self.bleach_options["strip"] = strip_tags
if strip_comments is not None:
self.bleach_options["strip_comments"] = strip_comments
def to_python(self, value):
"""
Strips any dodgy HTML tags from the input.
Mark the return value as template safe.
"""
if value in self.empty_values:
return self.empty_value
return mark_safe(bleach.clean(value, **self.bleach_options))
django-bleach-3.1.0/django_bleach/models.py 0000664 0000000 0000000 00000005415 14463323314 0020576 0 ustar 00root root 0000000 0000000 from bleach import clean
from bleach.css_sanitizer import CSSSanitizer
from django.db import models
from django.utils.safestring import mark_safe
from . import forms
from .utils import get_bleach_default_options
class BleachField(models.TextField):
def __init__(
self,
allowed_tags=None,
allowed_attributes=None,
allowed_styles=None,
allowed_protocols=None,
strip_tags=None,
strip_comments=None,
css_sanitizer=None,
*args,
**kwargs,
):
super().__init__(*args, **kwargs)
self.bleach_kwargs = get_bleach_default_options()
if allowed_tags:
self.bleach_kwargs["tags"] = allowed_tags
if allowed_attributes:
self.bleach_kwargs["attributes"] = allowed_attributes
if allowed_styles:
css_sanitizer = CSSSanitizer(allowed_css_properties=allowed_styles)
if css_sanitizer:
self.bleach_kwargs["css_sanitizer"] = css_sanitizer
if allowed_protocols:
self.bleach_kwargs["protocols"] = allowed_protocols
if strip_tags:
self.bleach_kwargs["strip"] = strip_tags
if strip_comments:
self.bleach_kwargs["strip_comments"] = strip_comments
def formfield(self, form_class=forms.BleachField, **kwargs):
"""Makes the field for a ModelForm"""
# If field doesn't have any choices add kwargs expected by BleachField.
if not self.choices:
kwargs.setdefault("widget", forms.get_default_widget())
kwargs.update(
{
"max_length": self.max_length,
"allowed_tags": self.bleach_kwargs.get("tags"),
"allowed_attributes": self.bleach_kwargs.get("attributes"),
"css_sanitizer": self.bleach_kwargs.get("css_sanitizer"),
"allowed_protocols": self.bleach_kwargs.get("protocols"),
"strip_tags": self.bleach_kwargs.get("strip"),
"strip_comments": self.bleach_kwargs.get("strip_comments"),
"required": not self.blank,
}
)
return super().formfield(form_class=form_class, **kwargs)
def pre_save(self, model_instance, add):
data = getattr(model_instance, self.attname)
if data is None:
return data
clean_value = clean(data, **self.bleach_kwargs) if data else ""
setattr(model_instance, self.attname, mark_safe(clean_value))
return clean_value
def from_db_value(self, value, expression, connection):
if value is None:
return value
# Values are sanitised before saving, so any value returned from the DB
# is safe to render unescaped.
return mark_safe(value)
django-bleach-3.1.0/django_bleach/templatetags/ 0000775 0000000 0000000 00000000000 14463323314 0021426 5 ustar 00root root 0000000 0000000 django-bleach-3.1.0/django_bleach/templatetags/__init__.py 0000664 0000000 0000000 00000000000 14463323314 0023525 0 ustar 00root root 0000000 0000000 django-bleach-3.1.0/django_bleach/templatetags/bleach_tags.py 0000664 0000000 0000000 00000002014 14463323314 0024231 0 ustar 00root root 0000000 0000000 import bleach
from django import template
from django.utils.safestring import mark_safe
from django_bleach.utils import get_bleach_default_options
register = template.Library()
@register.filter(name="bleach")
def bleach_value(value, tags=None):
if value is None:
return None
bleach_args = get_bleach_default_options()
if tags is not None:
args = bleach_args.copy()
args["tags"] = tags.split(",")
else:
args = bleach_args
bleached_value = bleach.clean(value, **args)
return mark_safe(bleached_value)
@register.filter
def bleach_linkify(value):
"""
Convert URL-like strings in an HTML fragment to links
This function converts strings that look like URLs, domain names and email
addresses in text that may be an HTML fragment to links, while preserving:
1. links already in the string
2. urls found in attributes
3. email addresses
"""
if value is None:
return None
return bleach.linkify(value, parse_email=True)
django-bleach-3.1.0/django_bleach/tests/ 0000775 0000000 0000000 00000000000 14463323314 0020076 5 ustar 00root root 0000000 0000000 django-bleach-3.1.0/django_bleach/tests/__init__.py 0000664 0000000 0000000 00000000000 14463323314 0022175 0 ustar 00root root 0000000 0000000 django-bleach-3.1.0/django_bleach/tests/test_forms.py 0000664 0000000 0000000 00000016611 14463323314 0022642 0 ustar 00root root 0000000 0000000 from bleach.css_sanitizer import CSSSanitizer
from django import forms
from django.test import TestCase, override_settings
from django.utils.safestring import SafeString
from django_bleach.forms import BleachField
from testproject.constants import (
ALLOWED_ATTRIBUTES,
ALLOWED_CSS_PROPERTIES,
ALLOWED_PROTOCOLS,
ALLOWED_STYLES,
ALLOWED_TAGS,
)
from testproject.forms import BleachForm, CustomBleachWidget
class TestBleachField(TestCase):
def test_empty(self):
"""
Test that the empty_value arg is returned for any input empty value
"""
for requested_empty_value in ("", None):
field = BleachField(empty_value=requested_empty_value)
for empty_value in field.empty_values:
self.assertEqual(
field.to_python(empty_value), requested_empty_value
)
def test_return_type(self):
"""Test bleached values are SafeString objects"""
field = BleachField()
self.assertIsInstance(field.to_python("some text"), SafeString)
def test_bleaching(self):
"""Test values are bleached"""
test_data = {
"no_tags": "