django-safe-filefield
Secure file field, which allows you to restrict uploaded file extensions. It may be useful for user-uploaded files (attachments).
This package adds model and forms field. What this fields does:
restricts allowed file extensions (for example: only *.pdf files)
checks file extensions is correct for sent content-type
checks sent content type is correct for file content (detects by libmagic)
checks uploaded file with anti-virus software
Installation
The package can be installed using:
pip install django-safe-filefieldAdd the following settings:
INSTALLED_APPS += [
'safe_filefield',
]django-safe-filefield requires libmagic to be installed.
Usage
Simply add field to your model:
from safe_filefield.models import SafeFileField
class MyModel(models.Model):
attachment = SafeFileField(
allowed_extensions=('xls', 'xlsx', 'csv')
)Or directly to your form:
from safe_filefield.forms import SafeFileField
class MyForm(forms.Form):
attachment = SafeFileField(
allowed_extensions=('xls', 'xlsx', 'csv')
)Content type checking
To check actual file content type, use check_content_type argument. This will prevent attacker from uploading malicious file just by changing its extension.
class MyForm(forms.Form):
attachment = SafeFileField(
check_content_type=True
)ClamAV support
This package has ability to check uploaded file with ClamAV antivirus.
To use anti-virus protection simply enable it in your form or model definition:
from safe_filefield.forms import SafeFileField
class MyForm(forms.Form):
attachment = SafeFileField(
scan_viruses=True,
)You can configure some ClamAV settings:
CLAMAV_SOCKET = 'unix://tmp/clamav.sock' # or tcp://127.0.0.1:3310
CLAMAV_TIMEOUT = 30 # 30 seconds timeout, None by default which means infiniteContributing
If you have any valuable contribution, suggestion or idea, please let me know as well because I will look into it.
Pull requests are welcome.
2 maintainers
Metadata
2 maintainers
Release files for django-safe-filefield 1.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| django-safe-filefield-1.0.0.tar.gz | 5.5 kB | Without provenance | Details for django-safe-filefield-1.0.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| django_safe_filefield-1.0.0-py3-none-any.whl | Python 3 | none | any | Details for django_safe_filefield-1.0.0-py3-none-any.whl |
Total release size: 12.3 kB
Release files / django-safe-filefield-1.0.0.tar.gz
| Download URL | django-safe-filefield-1.0.0.tar.gz |
|---|---|
| Size | 5.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f27b7770693b28716a5db8bd81f83b9bd501067284f6b69bf67a9ca4f21e415d
|
|
BLAKE2b-256 checksum How to use checksums |
15efeb5db1212eafb23e2cd6cea51c4a8c333c7ae402f2805dd268222815e3d5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.11.3
|
Release files / django_safe_filefield-1.0.0-py3-none-any.whl
| Download URL | django_safe_filefield-1.0.0-py3-none-any.whl |
|---|---|
| Size | 6.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
d08b0034e845ba78d2ab6e144b305bb5d7ee4a999c14861de22f8dc905a1ffe2
|
|
BLAKE2b-256 checksum How to use checksums |
131437c03153aaa513e3a4ea1c215a89b26df0b810f1c0fa275f71f716a4fcd5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.11.3
|
Security for django-safe-filefield 1.0.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
