CODEWITHSUNDEEP
pythondjangoformssanitization
abolotnov
abolotnov

Reputation: 4332

Sanitizing HTML in submitted form data

Is there a generic "form sanitizer" that I can use to ensure all html/scripting is stripped off the submitted form? form.clean() doesn't seem to do any of that - html tags are all still in cleaned_data. Or actually doing this all manually (and override the clean() method for the form) is my only option?

Upvotes: 39

Views: 29069

Answers (3)

simao
simao

Reputation: 15529

strip_tags actually removes the tags from the input, which may not be what you want.

To convert a string to a "safe string" with angle brackets, ampersands and quotes converted to the corresponding HTML entities, you can use the escape filter:

from django.utils.html import escape
message = escape(form.cleaned_data['message'])

Upvotes: 55

Wtower
Wtower

Reputation: 19902

Alternatively, there is a Python library called bleach:

Bleach is a whitelist-based HTML sanitization and text linkification library. It is designed to take untrusted user input with some HTML.

Because Bleach uses html5lib to parse document fragments the same way browsers do, it is extremely resilient to unknown attacks, much more so than regular-expression-based sanitizers.

Example:

import bleach
message = bleach.clean(form.cleaned_data['message'], 
                       tags=ALLOWED_TAGS,
                       attributes=ALLOWED_ATTRIBUTES, 
                       styles=ALLOWED_STYLES, 
                       strip=False, strip_comments=True)

Upvotes: 35

Bernhard Vallant
Bernhard Vallant

Reputation: 50786

Django comes with a template filter called striptags, which you can use in a template:

value|striptags

It uses the function strip_tags which lives in django.utils.html. You can utilize it also to clean your form data:

from django.utils.html import strip_tags
message = strip_tags(form.cleaned_data['message'])

Upvotes: 36

Related Questions