Package: django-bleach
Bleachis a Python module that takes any HTML input, and returns
valid, sanitised HTML that contains only an allowed subset of HTML tags,
attributes and styles.django-bleachis a Django app that makes usingbleachextremely easy.Read the documentation here.SetupInstalldjango-bleachviapip:pip install django-bleachAdddjango-bleachto yourINSTALLED_APPS:INSTALLED_APPS=[# ...'django_bleach',# ...]Select some sensible defaults for the allowed tags, attributes and styles;
and the behaviour when unknown tags are encountered. Each of these are
optional, and default to using thebleachdefaults. See thebleach documentation:# Which HTML tags are allowedBLEACH_ALLOWED_TAGS=['p','b','i','u','em','strong','a']# Which HTML attributes are allowedBLEACH_ALLOWED_ATTRIBUTES=['href','title','style']# Which CSS properties are allowed in 'style' attributes (assuming# style is an allowed attribute)BLEACH_ALLOWED_STYLES=['font-family','font-weight','text-decoration','font-variant']# Strip unknown tags if True, replace with HTML escaped characters if# FalseBLEACH_STRIP_TAGS=True# Strip comments, or leave them in.BLEACH_STRIP_COMMENTS=FalseSelect the default widget for bleach fields. This defaults todjango.forms.Textarea, but you will probably want to replace it with a
WYSIWYG editor, or something similar:# Use the CKEditorWidget for bleached HTML fieldsBLEACH_DEFAULT_WIDGET='wysiwyg.widgets.WysiwygWidget'I usedjango-ckeditorin my projects, but what you use is up to you.UsageIn your modelsdjango-bleachprovides three ways of creating bleached output. The simplest
way of including user-editable HTML content that is automatically sanitised is
by using theBleachFieldmodel field:# in app/models.pyfromdjangoimportmodelsfromdjango_bleach.modelsimportBleachFieldclassPost(models.Model):title=models.CharField()content=BleachField()# ...BleachFieldtakes the following arguments, to customise the output ofbleach. See thebleach documentationfor their use:allowed_tagsallowed_attributesstrip_tagsstrip_commentscss_sanitizerThe following argument will be deprecated in the near future:allowed_stylesIn addition to thebleach-specific arguments, theBleachFieldmodel field
accepts all of the normal field attributes. Behind the scenes, it is aTextField, and accepts all the same arguments as the defaultTextFielddoes.TheBleachFieldmodel field sanitises its value before it is saved to the
database and is marked safe so it can be immediately rendered in a template
without further intervention.In model forms,BleachFieldmodel field are represented with theBleachFieldform field by default.In your formsABleachFieldform field is provided. This field sanitises HTML input from
the user, and presents safe, clean HTML to your Django application and the
returned value is marked safe for immediate rendering.In your templatesIf you have a piece of content from somewhere that needs to be printed in a
template, you can use thebleachfilter:{%loadbleach_tags%}{{some_unsafe_content|bleach}}If filter has no arguments it uses default settings defined in your
application settings. You can override allowed tags by specifying them
as a parameter to the filter:{{some_unsafe_content|bleach:"p,span"}}There is alsobleach_linkifywhich uses thelinkifyfunction of bleach
which converts URL-like strings in an HTML fragment to linksThis function converts strings that look like URLs, domain names and email
addresses in text that may be an HTML fragment to links, while preserving:links already in the stringurls found in attributesemail addresses