input-sanitizer 0.1.9

Sanitizes input data to prevent XSS i.e. cross site scripting attacks.

A tool for removing malicious content from input data before saving data into database. It takes input containing HTML with XSS scripts and returns valid HTML in the output. It is a wrapper around Python’s bleach library to easily integrate it with Django framework.

Setup

1. Install input-sanitizer via pip:

   pip install input-sanitizer

2. Add input-sanitizer to your INSTALLED_APPS:

   INSTALLED_APPS = [
       # ...
       'input_sanitizer',
       # ...
   ]

3. Add default configurations for allowed tags, etc in settings.py. These configurations are optional and will defaults to using the bleach defaults. Refer to bleach documentation for their use:

   # tags which are allowed
   BLEACH_ALLOWED_TAGS = ["div", "section", "a", "i"]
   
   # remove all tags from input
   BLEACH_STRIP_TAGS = True
   
   
   # remove comments from input
   BLEACH_STRIP_TAGS = True
   
   # Strip comments, or leave them in.
   BLEACH_STRIP_COMMENTS = True

Usage

In Django Models

input-sanitizer provides two custom model fields SanitizedCharField and SanitizedTextField to automatically remove malicious content from input before saving data into database, but keep in mind that it won’t work with bulk update, bulk create, etc as these operations are done at the database level. You can still manually sanitize input data to use for bulk update, bulk create, etc operations.

# in models.py
from django import models
from input_sanitizer import sanitized_fields

class User(models.Model):
    username = sanitized_fields.SanitizedCharField()
    info = sanitized_fields.SanitizedTextField()

SanitizedCharField and SanitizedTextField may take following arguments to alter cleaning behaviour. Please, refer bleach documentation for their use:

• allowed_tags

• strip_comments

• strip_tags

SanitizedCharField is a extension of Django’s CharField and therefore, it will accept all normal CharField arguments.

SanitizedTextField is a extension of Django’s TextField and therefore, it will accept all normal TextField arguments.

In Views

To manually sanitize data, you can use sanitize_data function. It can be used to sanitize data to be used for bulk update, bulk create, etc.

from input_sanitizer import sanitizers
cleaned_data = sanitizers.sanitize_data(data, bleach_kwargs={})

bleach_kwargs arguments are optional and will default to using the bleach defaults. You may pass following arguments to alter cleaned output as per your requirement.

• allowed_tags

• strip_comments

• strip_tags