django-safe-template-engine 1.2.0

A Django template engine to render untrusted template code

Django Safe Template Engine

Django template engine to render untrusted template code

Table of contents

• Requirements
• Available tools
  • Template engine
  • Validator
• Trusted built-ins
  • Trusted tags
  • Trusted filters
• Contribute
  • How to contribute
  • Code formatting and tests
  • Ignore code formatting revisions from git blame

Requirements

• Python 3.8 to 3.12
• Django 3.2 (officially supported in automated tests, all built-in template tags and filters reviewed)

Available tools

Template engine

from django.template import Template
from django_safe_template_engine.engine import SafeTemplateEngine

safe_engine = SafeTemplateEngine()
Template(source, engine=safe_engine)

Validator

from django_safe_template_engine.validators import validate_safe_engine_template_syntax

template_code = '{% include "hacked.html" %}'
validate_safe_engine_template_syntax(template_code)

Trusted built-ins

The following tags and filters are allowed by this template engine.

Trusted tags

• autoescape
• comment
• cycle
• filter
• firstof
• for
• for … empty
• if
• ifchanged
• lorem
• now
• regroup
• resetcycle
• spaceless
• templatetag
• url
• verbatim
• widthratio
• with

Trusted filters

• add
• addslashes
• capfirst
• center
• cut
• date
• default_if_none
• default
• dictsort
• dictsortreversed
• divisibleby
• escape
• escapejs
• filesizeformat
• first
• floatformat
• force_escape
• get_digit
• iriencode
• join
• json_script
• last
• length_is
• length
• linebreaks
• linebreaksbr
• linenumbers
• ljust
• lower
• make_list
• phone2numeric
• pluralize
• random
• rjust
• safe
• safeseq
• slice
• slugify
• stringformat
• striptags
• time
• timesince
• timeuntil
• title
• truncatechars_html
• truncatechars
• truncatewords_html
• truncatewords
• unordered_list
• upper
• urlencode
• urlize
• urlizetrunc
• wordcount
• wordwrap
• yesno

Contribute

How to contribute

You want to add awesome features to Django Safe Template Engine? Here's how!

1. Fork this repository
2. Commit and push to your forked repository
3. Open a pull request to merge your work into this repository

Code formatting and tests

Here is how to run the code formatting / type checking tools, and run the test suite.

1. [Recommended] Create a Python venv for this repository:

   python3 -m venv .venv
   source .venv/bin/activate
   

2. Install the dependencies:

   cd tests/ && pip install -r requirements.txt && cd ..
   

3. Run the code formatting tools:

   black code formatter:

   black src tests
   

   isort import sorter:

   isort --settings-path isort.cfg src tests
   

   flake8 coding style checker:

   flake8 --config .flake8 src tests
   

   mypy type checker:

   mypy --config-file mypy.ini src tests
   

4. Run the test suite:

   python run_tests.py
   

Ignore code formatting revisions from git blame

For a more relevant git blame you can set up your git to use the file .git-blame-ignore-revs in blame.ignoreRevsFile:

git config blame.ignoreRevsFile .git-blame-ignore-revs