All geek questions in one place

Creating Custom HTML Templates

I want to allow users to create tiny templates that I then process in Django with a predefined context. I assume Django's rendering is safe (I asked a question about this before ), but there is still a risk of cross-site scripting, and I would like to prevent this. One of the main requirements of these templates is that the user should have some control over the layout of the page, and not just from the semantics. I see a couple of solutions:

  • Allow the user to use HTML, but at the last stage filter out dangerous tags manually (things such as <script>and <a onclick='..'>. I'm not very keen on this option, because I'm afraid I might miss out on some of them Moreover, the user can still use absolute positioning <divs>to spoil a thing or two on the rest of the page.
  • Use a markup language that creates secure HTML. From what I see in most markup languages, I could remove any html and then process the result. The problem is that most markup languages ​​are not very powerful. As far as I could see, there is no way to center elements in Markdown, even in ReST. A pro professional is that some markup languages ​​are well-documented, and users may already know how to use them.
  • Come up with proprietary markup. The cons that I see here are pretty much meant by the word "property."

So, to summarize: Is there some safe and easy way to "purify" HTML - preventing xss - or is there a reasonably ubiquitous markup language that gives some control over layout and styling.

Resources:

+3
source share
4 answers

There is a PHP-based HTML cleaner , I have not used it myself yet, but I heard very good things about It. They promise a lot:

HTML- - -    HTML-,   PHP. HTML    ( XSS) ,   , ,    ,    ,    W3C.

, , Python. : @Matchu Python, .

, , Flash . , position: absolute ( position: relative, , .) , , , , - EBay allow, ? - , , , .

EBay:

, , , , HTML, , . (, , .)

+1

Pekka, Google HTML Python. : Python HTML Sanitizer. , .

+3

" , HTML".

, .

" , ".

False.

" ReST.

False.

- - CSS - .

  • - CSS . .. class:: .

  • , <span>.

+1

. , , .

The big problem is to prevent the creation of a templated system from infinite loops and recursion. This is an obvious threat to system performance, but depending on the deployment and deployment configuration, the server may never fail. With a finite number of python threads at your disposal, repeated calls to the wrong template can quickly bring your site down.

0
source

Source: https://habr.com/ru/post/1734915/

More articles:


All Articles