Package: input-sanitizer
A tool for removing malicious content from input data before saving data into database.
It takes input containing HTML with XSS scripts and returns valid HTML in the output.
It is a wrapper around Python’sbleachlibrary to easily integrate it with Django framework and it implements whitelist based approach to remove harmful content.SetupInstallinput-sanitizerviapip:pip install input-sanitizerAddinput-sanitizerto yourINSTALLED_APPS:INSTALLED_APPS=[# ...'input_sanitizer',# ...]Add default configurations for allowed tags, etc insettings.py. These configurations are optional and will defaults to using thebleachdefaults. Refer tobleachdocumentation for their use:# tags which are allowedBLEACH_ALLOWED_TAGS=["div","section","a","i"]# remove all tags from inputBLEACH_STRIP_TAGS=True# remove comments, or allow them inBLEACH_STRIP_COMMENTS=TrueUsageIn Django Modelsinput-sanitizerprovides two custom model fieldsSanitizedCharFieldandSanitizedTextFieldtoautomaticallyremove malicious content from input before saving data into database, but keep in mind that it won’t work withbulk update,bulk create, etc as these operations are done at the database level. You can still manually sanitize input data to use forbulk update,bulk create, etc operations.# in models.pyfromdjangoimportmodelsfrominput_sanitizerimportsanitized_modelsclassUser(models.Model):username=sanitized_models.SanitizedCharField()info=sanitized_models.SanitizedTextField()SanitizedCharFieldandSanitizedTextFieldmay take following arguments to alter cleaning behaviour.
Please, refer tobleachdocumentation for their use:allowed_tags: Tags which are allowedstrip_comments: Remove comments from datastrip_tags: Remove all tags from dataSanitizedCharFieldis a extension of Django model’s CharField and therefore, it will accept all normal CharField arguments.SanitizedTextFieldis a extension of Django model’s TextField and therefore, it will accept all normal TextField arguments.In Django FormsSanitizedCharFieldandSanitizedTextFieldfields can be used to clean XSS content from form fields while validating and saving the form data.# in forms.pyfromdjangoimportformsfrominput_sanitizerimportsanitized_formsclassUser(forms.ModelForm):username=sanitized_forms.SanitizedCharField()info=sanitized_forms.SanitizedTextField()SanitizedCharFieldandSanitizedTextFieldmay take following arguments to alter cleaning behaviour.
Please, refer tobleachdocumentation for their use:allowed_tags: Tags which are allowedstrip_comments: Remove comments from datastrip_tags: Remove all tags from dataSanitizedCharFieldandSanitizedTextFieldfields will return validation errors if these fields are required. You can provide following arguments to customize error messages.FIELD_ERRORtakes precedence overFIELD_NAMEwhile returning error message.FIELD_ERROR: Error messageFIELD_NAME: Field nameSanitizedCharFieldis a extension of Django form’s CharField. It will accept all normal CharField arguments.SanitizedTextFieldis a extension of Django form’s TextField. It will accept all normal TextField arguments.In DRF SerializersSanitizedCharFieldandSanitizedTextFieldfields can be used to clean XSS content from serializer fields while validating and saving the serializer data.# in serializers.pyfromrest_frameworkimportserializersfrominput_sanitizerimportsanitized_serializersclassUser(serializers.ModelSerializer):username=sanitized_serializers.SanitizedCharField()info=sanitized_serializers.SanitizedTextField()SanitizedCharFieldandSanitizedTextFieldmay take following arguments to alter cleaning behaviour.
Please, refer tobleachdocumentation for their use:allowed_tags: Tags which are allowedstrip_comments: Remove comments from datastrip_tags: Remove all tags from dataSanitizedCharFieldandSanitizedTextFieldfields will return validation errors if these fields are required. You can provide following arguments to customize error messages.FIELD_ERRORtakes precedence overFIELD_NAMEwhile returning error message.FIELD_ERROR: Error messageFIELD_NAME: Field nameSanitizedCharFieldis a extension of DRF serializer’s CharField. It will accept all normal CharField arguments.SanitizedTextFieldis a extension of DRF serializer’s TextField. It will accept all normal TextField arguments.In ViewsTo manually sanitize data, you can usesanitize_datafunction.
It can be used to sanitize data to be used forbulk update,bulk create, etc.frominput_sanitizerimportsanitizerscleaned_data=sanitizers.sanitize_data(data,bleach_kwargs={})bleach_kwargsarguments are optional and will default to using thebleachdefaults.
You may pass following arguments to alter cleaned output as per your requirement.allowed_tags: Tags which are allowedstrip_comments: Remove comments from datastrip_tags: Remove all tags from data