CODEWITHSUNDEEP
wagtailwagtail-streamfield
AJH
AJH

Reputation: 275

Wagtail insert code into body (streamfield)

Is it possible to insert html in any other way than RawHTML? RawHTML is a threat and was wondering if I could do it another way.

Thanks in advance!

Upvotes: 1

Views: 396

Answers (1)

nimasmi
nimasmi

Reputation: 4138

As @gasman says in his comment on the question, inserting HTML carries the same risks no matter what form field you give your editors to do it.

However, you can implement a .clean() method on your block type which sanitises the HTML using Bleach.

e.g. to allow only <p> tags: 

>>> raw_html = """<p id='foo' class='dangerous'>
<script>console.log('bar');</script>
<b>Hello</b>
</p>"""
>>> html = bleach.clean(raw_html,
                        tags=['p'],
                        attributes={'p': ['id']},
                        strip=True)
>>> print(html)
<p id='foo'>Hello</p>

Upvotes: 2

Related Questions