Package: django-argonauts
A lightweight collection of JSON helpers for Django. Includes a template filter
for safely outputting JSON, views that encode and decode JSON, and a helper for
writing simple REST views.A special JSON encoder is used to serialize QuerySets and objects withto_jsonmethods.FilterYou can serialize an object in JSON using the|jsonfilter. This is useful
to generate safe JavaScript:{% load argonauts %}<scripttype="application/javascript">(function(){varobject_list={{object_list|json}};// do something with object_list})();</script>|jsonis safe to use anywhere in XML or XHTML except in an attribute. It’s
important to use this tag rather than dumping the output ofjson.dumpsinto
HTML, because an attacker could output a closing tag and effect an XSS attack.
For example, if we outputjson.dumps("</script><script>console.log('xss');//")in template like this:<script>varsomedata={{somedata_as_json|safe}};</script>We get:<script>varsomedata="</script><script>console.log('xss');//";</script>This allows the attacker to inject their own JavaScript. The|jsontag
prevents this by encoding the closing</script>tag with JSON’s unicode
escapes. If we output{{ somedata|json }}, we get:<script>varsomedata="\u0060xscript\u0062x\u0060xscript\u0062xconsole.log('xss');//";</script>It also escapes ampersands in order to generate valid XML. For example, with the valuefoo & bar:<document><json>{{value|json}}</json></document><!-- Results in valid XML:
<document><json>"foo \u0038x bar"</json></document>
-->ViewsJsonResponseMixinJsonResponseMixinimplementsrender_to_responsemethod that serializes
an object into a JSON response. Thus it is compatible with generic Django
views:fromdjango.dbimportmodelsfromdjango.views.generic.detailimportBaseDetailViewfromargonauts.viewsimportJsonResponseMixinclassBlog(models.Model):title=models.CharField(max_length=255)body=models.TextField()defto_json(self):return{'title':self.title,'body':self.body,}classBlogDetailView(JsonResponseMixin,BaseDetailView):"""
    Detail view returning object serialized in JSON
    """model=BlogJsonRequestMixinJsonRequestMixingives access to the request data throughdata()method.fromdjango.views.generic.baseimportViewfromargonauts.viewsimportJsonRequestMixin:fromargonauts.httpimportJsonResponseclassEchoView(JsonRequestMixin,View):defdispatch(self,*args,**kwargs):returnJsonResponse(self.data())RestViewRestViewis an abstract class. Subclasses should implementauth(), for
handling authentication, and at least one HTTP method.RestViewimplementsOPTIONShttp method, and inherits fromJsonRequestMixinandJsonResponseMixin.fromdjango.core.exceptionsimportPermissionDeniedfromargonauts.viewsimportRestViewfrom.utilsimportget_actionclassCrazyRestView(RestView):defauth(self,*args,**kwargs):ifnotself.request.user.is_superuser:raisePermissionDenieddefpost(self,*args,**kwargs):action=kwargs.pop('action')action_func=get_action(action)returnself.render_to_response(action_func(self.data()))Changelog1.2.0 (2016-09-20)Add support for requests without a Content-Type header to JsonTestClientRemove support for old versions of Django (<= 1.7)1.1.4 (2015-07-29)Tests mocked http requests don’t always have charset1.1.3 (2015-05-27)Fixed package (include the CHANGELOG inMANIFEST.in)1.1.2 (2015-05-27)AddedJsonTestCaseandJsonTestMixin1.1.1 (2015-04-20)Fixed package1.1.0 (2015-04-20)Cleanup:Dropped support for Django 1.3Added support for Python 3Updated documentationSwitched testing to py.testSwitched to zest.releaser1.0.1 (2013-10-06)Fixed tests1.0.0 (2013-07-05)Initial release:Extracted from django-fusionboxSafe JSON SerializerSafe JSON template filterJSON Views