Login

HTML5 filter for XXS

Author:
ronnie
Posted:
May 20, 2011
Language:
Python
Version:
1.2
Score:
0 (after 0 ratings)

Usefull for TinyMCE, to allow some HTML but be vunarable by XXS attacks

You need to install html5lib

sudo easy_install html5lib

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
from django import template
from django.template.defaultfilters import stringfilter

register = template.Library()

import html5lib
from html5lib import sanitizer

@register.filter
@stringfilter
def sanitize(value):
    p = html5lib.HTMLParser(tokenizer=sanitizer.HTMLSanitizer)
    return p.parseFragment(value).toxml()

More like this

  1. Template tag - list punctuation for a list of items by shapiromatron 10 months, 1 week ago
  2. JSONRequestMiddleware adds a .json() method to your HttpRequests by cdcarter 10 months, 2 weeks ago
  3. Serializer factory with Django Rest Framework by julio 1 year, 5 months ago
  4. Image compression before saving the new model / work with JPG, PNG by Schleidens 1 year, 6 months ago
  5. Help text hyperlinks by sa2812 1 year, 6 months ago

Comments

st0w (on May 30, 2011):

Once change I had to make - despite trying to add

sanitize.is_safe = True

after the last line you had, Django was still interpreting the results of this as unsafe and proceeding to escape all the special characters. Which somewhat defeats the purpose of having a smart library like html5lib handle it. I had to add one import

from django.utils.safestring import mark_safe

and change your return statement to this:

return mark_safe(p.parseFragment(value).toxml())

Thanks for the snippet!

#

Please login first before commenting.