CODEWITHSUNDEEP
pythondjangosecurityxss
neolaser
neolaser

Reputation: 6907

Django: allow safe html tags

Im looking into XSS with various frameworks and CMS and whether they provide methods in protecting against it (not just programmaticly avoiding the situation).

I know that in Djangos templating language you can specify a variable as |safe I want to be able to allow actually safe html tags so the user can format text (simple things like etc), but strip such things as , onload attributes etc.

I would like to know whether Django recommends a method in doing this, not just using Python. I hope this makes sense

Jason

Upvotes: 1

Views: 2055

Answers (1)

Alex Jillard
Alex Jillard

Reputation: 2832

One of the core concepts of Django is that it's Python, and any Python lib should be usable with Django. They won't recreate the wheel unless there is good reason to. I believe HTML scrubbing/sanitizing is one of the things they've decided not to recreate.

BeautifulSoup is the python library you want to look into for any scrubbing/sanitizing though.

Upvotes: 1

Related Questions