django-html_sanitizer 0.1.5

Dependencies

• django: http://djangoproject.com/

• bleach: http://github.com/jsocol/bleach

Installation

You’ll first need to install the package (or download manually from pypi):

pip install django-html_sanitizer

And then add sanitizer to your INSTALLED_APPS in django’s settings.py:

INSTALLED_APPS = (
    # other apps
    "sanitizer",
)

Model Usage

Similar to bleach, django sanitizer is a whitelist (only allows specified tags and attributes) based HTML sanitizer. Django sanitizer provides two model fields that automatically sanitizes text values; SanitizedCharField and SanitizedTextField.

These fields accept extra arguments:

• allowed_tags: a list of allowed HTML tags

• allowed_attributes: a list of allowed HTML attributes, or a dictionary of tag keys with atttribute list for each key

• allowed_styles: a list of allowed styles if “style” is one of the allowed attributes

• strip: a boolean indicating whether offending tags/attributes should be escaped or stripped

Here’s how to use it in django models:

from django.db import models
from sanitizer.models import SanitizedCharField, SanitizedTextField

class MyModel(models.Model):
    # Allow only <a>, <p>, <img> tags and "href" and "src" attributes
    foo = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
                             allowed_attributes=['href', 'src'], strip=False)
    bar = SanitizedTextField(max_length=255, allowed_tags=['a', 'p', 'img'],
                             allowed_attributes=['href', 'src'], strip=False)
    foo2 = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
                             allowed_attributes={'img':['src', 'style']},
                             allowed_styles=['width', 'height'], strip=False)

Form Usage

Using django HTML sanitizer in django forms is very similar to model usage:

from django import forms
from sanitizer.forms import SanitizedCharField

class MyForm(forms.Form):
    # Allow only <a>, <p>, <img> tags and "href" and "src" attributes
    foo = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
                             allowed_attributes=['href', 'src'], strip=False)
    bar = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
                             allowed_attributes=['href', 'src'], strip=False, widget=forms.Textarea)
    foo2 = SanitizedCharField(max_length=255, allowed_tags=['a', 'p', 'img'],
                             allowed_attributes={'img':['src', 'style']},
                             allowed_styles=['width', 'height'], strip=False)

Template Usage

Django sanitizer provides a few differents ways of cleaning HTML in templates.

{% load sanitizer %}
{% escape_html post.content "a, p, img" "href, src, style" "width"%}

'<a href ="#" style="width:200px;">Example</a>&lt;script&gt;alert("x")&lt;/script&gt;'

{% escape_html '<a href="">bar</a>' allowed_tags="a,img" allowed_attributes="href,src" allowed_styles="width" %}

{% load sanitizer %}
{% strip_html post.content "a, p, img" "href, src" %}

'<a href ="#">Example</a>alert("x")'

{% load sanitizer %}
{{ post.content|escape_html }}

'<a href ="#" style="width=200px;">Example</a>&lt;script&gt;alert("x")&lt;/script&gt;'

{% load sanitizer %}
{{ post.content|strip_html }}

'<a href ="#">Example</a>alert("x")'

Changelog