, , , , , , tags and "href" and "src" attributes
foo = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False)
bar = SanitizedTextField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False)
foo2 = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes={'img':['src', 'style']},
allowed_styles=['width', 'height'], strip=False)
Form Usage
==========
Using django HTML sanitizer in django forms is very similar to model usage::
from django import forms
from sanitizer.forms import SanitizedCharField
class MyForm(forms.Form):
# Allow only ,
tags and "href" and "src" attributes
foo = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False)
bar = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False, widget=forms.Textarea)
foo2 = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes={'img':['src', 'style']},
allowed_styles=['width', 'height'], strip=False)
Template Usage
==============
Django sanitizer provides a few differents ways of cleaning HTML in templates.
``escape_html`` Template Tag
----------------------------
Example usage::
{% load sanitizer %}
{% escape_html post.content "a, p, img" "href, src, style" "width"%}
Assuming ``post.content`` contains the string
'Example', the above tag will
output::
'Example<script>alert("x")</script>'
On django 1.4 you could also use keyword arguments::
{% escape_html 'bar' allowed_tags="a,img" allowed_attributes="href,src" allowed_styles="width" %}
``strip_html`` Template Tag
---------------------------
Example usage::
{% load sanitizer %}
{% strip_html post.content "a, p, img" "href, src" %}
If ``post.content`` contains the string
'Example', this will give you::
'Examplealert("x")'
``escape_html`` Filter
----------------------
Escapes HTML tags from string based on settings. To use this filter you need to
put these variables on settings.py:
* ``SANITIZER_ALLOWED_TAGS`` - a list of allowed tags (defaults to an empty list)
* ``SANITIZER_ALLOWED_ATTRIBUTES`` - a list of allowed attributes (defaults to an empty list)
* ``SANITIZER_ALLOWED_STYLES`` - a list of allowed styles if the style attribute is set (defaults to an empty list)
For example if we have ``SANITIZER_ALLOWED_TAGS = ['a']``,
``SANITIZER_ALLOWED_ATTRIBUTES = ['href']``,
``SANITIZER_ALLOWED_STYLES = ['width']`` in settings.py, doing::
{% load sanitizer %}
{{ post.content|escape_html }}
If ``post.content`` contains the string
'Example', it will give you::
'Example<script>alert("x")</script>'
``strip_html`` Filter
---------------------
Similar to ``escape_html`` filter, except it strips out offending HTML tags.
For example if we have ``SANITIZER_ALLOWED_TAGS = ['a']``,
``SANITIZER_ALLOWED_ATTRIBUTES = ['href']`` in settings.py, doing::
{% load sanitizer %}
{{ post.content|strip_html }}
If ``post.content`` contains the string
'Example', we will get::
'Examplealert("x")'
Changelog
=========
Version 0.1.5
-------------
* Fixes for smart_unicode and basestring (python 3.x support)
Version 0.1.4
-------------
* ``CharField``, ``TextField``, ``strip_html`` and ``escape_html`` now support
``allowed_styles`` (thanks `cltrudeau
tags and "href" and "src" attributes
foo = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False)
bar = SanitizedTextField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False)
foo2 = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes={'img':['src', 'style']},
allowed_styles=['width', 'height'], strip=False)
Form Usage
==========
Using django HTML sanitizer in django forms is very similar to model usage::
from django import forms
from sanitizer.forms import SanitizedCharField
class MyForm(forms.Form):
# Allow only ,
tags and "href" and "src" attributes
foo = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False)
bar = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False, widget=forms.Textarea)
foo2 = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes={'img':['src', 'style']},
allowed_styles=['width', 'height'], strip=False)
Template Usage
==============
Django sanitizer provides a few differents ways of cleaning HTML in templates.
``escape_html`` Template Tag
----------------------------
Example usage::
{% load sanitizer %}
{% escape_html post.content "a, p, img" "href, src, style" "width"%}
Assuming ``post.content`` contains the string
'Example', the above tag will
output::
'Example<script>alert("x")</script>'
On django 1.4 you could also use keyword arguments::
{% escape_html 'bar' allowed_tags="a,img" allowed_attributes="href,src" allowed_styles="width" %}
``strip_html`` Template Tag
---------------------------
Example usage::
{% load sanitizer %}
{% strip_html post.content "a, p, img" "href, src" %}
If ``post.content`` contains the string
'Example', this will give you::
'Examplealert("x")'
``escape_html`` Filter
----------------------
Escapes HTML tags from string based on settings. To use this filter you need to
put these variables on settings.py:
* ``SANITIZER_ALLOWED_TAGS`` - a list of allowed tags (defaults to an empty list)
* ``SANITIZER_ALLOWED_ATTRIBUTES`` - a list of allowed attributes (defaults to an empty list)
* ``SANITIZER_ALLOWED_STYLES`` - a list of allowed styles if the style attribute is set (defaults to an empty list)
For example if we have ``SANITIZER_ALLOWED_TAGS = ['a']``,
``SANITIZER_ALLOWED_ATTRIBUTES = ['href']``,
``SANITIZER_ALLOWED_STYLES = ['width']`` in settings.py, doing::
{% load sanitizer %}
{{ post.content|escape_html }}
If ``post.content`` contains the string
'Example', it will give you::
'Example<script>alert("x")</script>'
``strip_html`` Filter
---------------------
Similar to ``escape_html`` filter, except it strips out offending HTML tags.
For example if we have ``SANITIZER_ALLOWED_TAGS = ['a']``,
``SANITIZER_ALLOWED_ATTRIBUTES = ['href']`` in settings.py, doing::
{% load sanitizer %}
{{ post.content|strip_html }}
If ``post.content`` contains the string
'Example', we will get::
'Examplealert("x")'
Changelog
=========
Version 0.1.5
-------------
* Fixes for smart_unicode and basestring (python 3.x support)
Version 0.1.4
-------------
* ``CharField``, ``TextField``, ``strip_html`` and ``escape_html`` now support
``allowed_styles`` (thanks `cltrudeau
', 'br'), 'test
')
self.assertEqual(sanitize_allow('test
', 'br'), 'test
')
self.assertEqual(sanitize_allow('test', 'a'), 'test')
self.assertEqual(sanitize_allow('test', 'a; href'), 'test')
def test_SanitizedCharField(self):
TestingModel.objects.create(test_field='foobar')
test = TestingModel.objects.latest('id')
self.assertEqual(test.test_field, 'foo<em>bar</em>')
def test_SanitizedTextField(self):
TestingTextModel.objects.create(test_field='foobar')
test = TestingTextModel.objects.latest('id')
self.assertEqual(test.test_field, 'foo<em>bar</em>')
def test_SanitizedFormField(self):
html = 'foo'
form = TestForm({ 'test_field': html })
form.is_valid()
self.assertEqual(form.cleaned_data['test_field'],
'foo<em class=""></em>')
def test_escape_html(self):
html = 'foo'
self.assertEqual(escape_html(html, allowed_tags='a',
allowed_attributes='href,style', allowed_styles='width'),
'foo<em></em>')
self.assertEqual(escape_html(html, allowed_tags=['a'],
allowed_attributes=['href', 'style'], allowed_styles=['width']),
'foo<em></em>')
def test_strip_html(self):
html = 'foo'
self.assertEqual(strip_html(html, allowed_tags='a',
allowed_attributes='href,style', allowed_styles='width'),
'foo')
self.assertEqual(strip_html(html, allowed_tags=['a'],
allowed_attributes=['href', 'style'], allowed_styles=['width']),
'foo')
django-html_sanitizer-0.1.5/sanitizer/models.py 0000664 0001750 0001750 00000004656 12645323637 022532 0 ustar selwin selwin 0000000 0000000 from django.conf import settings
from django.db import models
import sys
if sys.version_info[0] == 3:
from django.utils.encoding import smart_text as smart_unicode
else:
from django.utils.encoding import smart_unicode
import bleach
class SanitizedCharField(models.CharField):
def __init__(self, allowed_tags=[], allowed_attributes=[],
allowed_styles=[], strip=False,
*args, **kwargs):
self._sanitizer_allowed_tags = allowed_tags
self._sanitizer_allowed_attributes = allowed_attributes
self._sanitizer_allowed_styles = allowed_styles
self._sanitizer_strip = strip
super(SanitizedCharField, self).__init__(*args, **kwargs)
def to_python(self, value):
value = super(SanitizedCharField, self).to_python(value)
value = bleach.clean(value, tags=self._sanitizer_allowed_tags,
attributes=self._sanitizer_allowed_attributes,
styles=self._sanitizer_allowed_styles, strip=self._sanitizer_strip)
return smart_unicode(value)
class SanitizedTextField(models.TextField):
def __init__(self, allowed_tags=[], allowed_attributes=[],
allowed_styles=[], strip=False,
*args, **kwargs):
self._sanitizer_allowed_tags = allowed_tags
self._sanitizer_allowed_attributes = allowed_attributes
self._sanitizer_allowed_styles = allowed_styles
self._sanitizer_strip = strip
super(SanitizedTextField, self).__init__(*args, **kwargs)
def to_python(self, value):
value = super(SanitizedTextField, self).to_python(value)
value = bleach.clean(value, tags=self._sanitizer_allowed_tags,
attributes=self._sanitizer_allowed_attributes,
styles=self._sanitizer_allowed_styles, strip=self._sanitizer_strip)
return smart_unicode(value)
def get_prep_value(self, value):
value = super(SanitizedTextField, self).get_prep_value(value)
value = bleach.clean(value, tags=self._sanitizer_allowed_tags,
attributes=self._sanitizer_allowed_attributes,
styles=self._sanitizer_allowed_styles, strip=self._sanitizer_strip)
return value
if 'south' in settings.INSTALLED_APPS:
from south.modelsinspector import add_introspection_rules
add_introspection_rules([], ["^sanitizer\.models\.SanitizedCharField"])
add_introspection_rules([], ["^sanitizer\.models\.SanitizedTextField"])
django-html_sanitizer-0.1.5/sanitizer/__init__.py 0000664 0001750 0001750 00000000066 12645323637 022775 0 ustar selwin selwin 0000000 0000000 VERSION = (0, 1, 4)
from .decorators import sanitize
django-html_sanitizer-0.1.5/sanitizer/decorators.py 0000664 0001750 0001750 00000002237 12645323637 023405 0 ustar selwin selwin 0000000 0000000 from django import forms
import bleach
def get_sanitized_clean_func(original_clean, **kwargs):
def fn(value):
value = original_clean(value)
if isinstance(value, basestring):
value = bleach.clean(value, **kwargs)
return value
return fn
class sanitize(object):
def __init__(self, tags=bleach.ALLOWED_TAGS,
attributes=bleach.ALLOWED_ATTRIBUTES, styles=[], strip=False,
strip_comments=True):
self.kwargs = {
'tags': tags,
'attributes': attributes,
'styles': styles,
'strip': strip,
'strip_comments': strip_comments,
}
def __call__(self, cls):
self.actual_decorator(cls)
return cls
def actual_decorator(self, cls):
fields = [(key, value) for key, value in cls.base_fields.iteritems() if isinstance(value, forms.CharField)]
for field_name, field_object in fields:
original_clean = getattr(field_object, 'clean')
clean_func = get_sanitized_clean_func(original_clean, **self.kwargs)
setattr(field_object, 'clean', clean_func)
django-html_sanitizer-0.1.5/sanitizer/forms.py 0000664 0001750 0001750 00000001445 12645323637 022366 0 ustar selwin selwin 0000000 0000000 from django import forms
import bleach
class SanitizedCharField(forms.CharField):
"""
A subclass of CharField that escapes (or strip) HTML tags and attributes.
"""
def __init__(self, allowed_tags=[], allowed_attributes=[],
allowed_styles=[], strip=False, *args, **kwargs):
self._allowed_tags = allowed_tags
self._allowed_attributes = allowed_attributes
self._allowed_styles = allowed_styles
self._strip = strip
super(SanitizedCharField, self).__init__(*args, **kwargs)
def clean(self, value):
value = super(SanitizedCharField, self).clean(value)
return bleach.clean(value, tags=self._allowed_tags,
attributes=self._allowed_attributes,
styles=self._allowed_styles, strip=self._strip)
django-html_sanitizer-0.1.5/django_html_sanitizer.egg-info/ 0000775 0001750 0001750 00000000000 12645324072 024714 5 ustar selwin selwin 0000000 0000000 django-html_sanitizer-0.1.5/django_html_sanitizer.egg-info/PKG-INFO 0000664 0001750 0001750 00000020322 12645324072 026010 0 ustar selwin selwin 0000000 0000000 Metadata-Version: 1.1
Name: django-html-sanitizer
Version: 0.1.5
Summary: Provides a set of HTML cleaning utilities for django models, forms and templates.
Home-page: https://github.com/ui/django-html_sanitizer
Author: Selwin Ong
Author-email: selwin.ong@gmail.com
License: MIT
Description: =====================
Django HTML Sanitizer
=====================
Django HTML Sanitizer provides a set of utilities to easily sanitize/escape/clean
HTML inputs in django. This app is built on top of `bleach tags and "href" and "src" attributes
foo = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False)
bar = SanitizedTextField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False)
foo2 = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes={'img':['src', 'style']},
allowed_styles=['width', 'height'], strip=False)
Form Usage
==========
Using django HTML sanitizer in django forms is very similar to model usage::
from django import forms
from sanitizer.forms import SanitizedCharField
class MyForm(forms.Form):
# Allow only ,
tags and "href" and "src" attributes
foo = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False)
bar = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes=['href', 'src'], strip=False, widget=forms.Textarea)
foo2 = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
allowed_attributes={'img':['src', 'style']},
allowed_styles=['width', 'height'], strip=False)
Template Usage
==============
Django sanitizer provides a few differents ways of cleaning HTML in templates.
``escape_html`` Template Tag
----------------------------
Example usage::
{% load sanitizer %}
{% escape_html post.content "a, p, img" "href, src, style" "width"%}
Assuming ``post.content`` contains the string
'Example', the above tag will
output::
'Example<script>alert("x")</script>'
On django 1.4 you could also use keyword arguments::
{% escape_html 'bar' allowed_tags="a,img" allowed_attributes="href,src" allowed_styles="width" %}
``strip_html`` Template Tag
---------------------------
Example usage::
{% load sanitizer %}
{% strip_html post.content "a, p, img" "href, src" %}
If ``post.content`` contains the string
'Example', this will give you::
'Examplealert("x")'
``escape_html`` Filter
----------------------
Escapes HTML tags from string based on settings. To use this filter you need to
put these variables on settings.py:
* ``SANITIZER_ALLOWED_TAGS`` - a list of allowed tags (defaults to an empty list)
* ``SANITIZER_ALLOWED_ATTRIBUTES`` - a list of allowed attributes (defaults to an empty list)
* ``SANITIZER_ALLOWED_STYLES`` - a list of allowed styles if the style attribute is set (defaults to an empty list)
For example if we have ``SANITIZER_ALLOWED_TAGS = ['a']``,
``SANITIZER_ALLOWED_ATTRIBUTES = ['href']``,
``SANITIZER_ALLOWED_STYLES = ['width']`` in settings.py, doing::
{% load sanitizer %}
{{ post.content|escape_html }}
If ``post.content`` contains the string
'Example', it will give you::
'Example<script>alert("x")</script>'
``strip_html`` Filter
---------------------
Similar to ``escape_html`` filter, except it strips out offending HTML tags.
For example if we have ``SANITIZER_ALLOWED_TAGS = ['a']``,
``SANITIZER_ALLOWED_ATTRIBUTES = ['href']`` in settings.py, doing::
{% load sanitizer %}
{{ post.content|strip_html }}
If ``post.content`` contains the string
'Example', we will get::
'Examplealert("x")'
Changelog
=========
Version 0.1.5
-------------
* Fixes for smart_unicode and basestring (python 3.x support)
Version 0.1.4
-------------
* ``CharField``, ``TextField``, ``strip_html`` and ``escape_html`` now support
``allowed_styles`` (thanks `cltrudeau