How do i do a custom field in django to "clean" an html field?

Question

I have a model with description field, this field can be html code, for security reasons I want to create a custom field to clear this code before saving to db.

I trying to use the lib bleach https://github.com/mozilla/bleach, but i don't know if I'm doing it right

this my customField

class HtmlField(models.TextField):
    description = 'Clean HTML field'

    def __init__(self, *args, **kwargs):
        bleach.clean(self.description)
        super().__init__(*args, **kwargs)

EDIT:

I can save the data the way I want, but I reebo this error not migrate: TypeError: argument cannot be of 'NoneType' type, must be of text type

EDIT2: I solved the previous problem by placing a check if the text is empty:

if not value:
             return ''

https://github.com/mozilla/bleach/issues/334

Willem Van Onsem · Accepted Answer · 2019-08-14T17:13:10.790

1

You can override the to_python function, like:

class HtmlField(models.TextField):
    description = 'Clean HTML field'

    def to_python(self, value):
        value = super().to_python(value)
        if value is None:
            return None
        return bleach.clean(value)

That being said, I'm not convinced that storing HTML code in the database is a security risk. The database does not render the html, it does not run the JavaScript parts, etc. See the question "Database for Content - OK to store HTML?" for more information.

edited Aug 14 '19 at 17:13

answered Aug 14 '19 at 14:29

Willem Van Onsem

443,496
30
428
555

Thanks i will test this, i think this too, but it's an exigence of project – GustavoNogueira Aug 14 '19 at 14:33
This works for me, thanks bro, and a tip for someone who is going to use this: https://bleach.readthedocs.io/en/latest/clean.html#allowed-tags-tags – GustavoNogueira Aug 14 '19 at 14:48
@GustavoNogueira: in case you want to automatically "unclean" it, you need to override the `from_db_value` function`: https://docs.djangoproject.com/en/2.2/ref/models/fields/#django.db.models.Field.from_db_value – Willem Van Onsem Aug 14 '19 at 14:53
i dont undestand your last comment – GustavoNogueira Aug 14 '19 at 15:58
@GustavoNogueira: can you please edit your question and share the full traceback? – Willem Van Onsem Aug 14 '19 at 16:41
Yes, one moment please – GustavoNogueira Aug 14 '19 at 16:43
@GustavoNogueira: what if you add a `None` check? – Willem Van Onsem Aug 14 '19 at 17:13

How do i do a custom field in django to "clean" an html field?

1 Answers1