Skip to content

Completly (including contents!) strip <script> and many other bad tags with lxml - fixes #6 #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
benzkji merged 2 commits into from
Apr 30, 2025
Merged

Completly (including contents!) strip <script> and many other bad tags with lxml - fixes #6 #11

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6a51a7d
feat: completely strip script and other tags contents
benzkji Apr 30, 2025
9b71ee8
Update helpers.py - try to please linter
benzkji Apr 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions postgres_searchindex/contrib/djangocms/helpers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@
from django.test import RequestFactory
from django.utils.html import strip_tags

try:
from lxml.html import clean as lxml_clean
from lxml.html import fragment_fromstring, tostring
except ImportError:
lxml_clean = None


def _render_plugin(plugin, context, renderer=None):
if renderer:
Expand Down Expand Up @@ -53,6 +59,15 @@ def get_plugin_index_content(base_plugin, request):
renderer = context.get("cms_content_renderer")

plugin_content = _render_plugin(instance, context, renderer)
if lxml_clean:
# defaults: most strict possible!
lxml_cleaner = lxml_clean.Cleaner()
fragment = fragment_fromstring("<div>" + plugin_content + "</div>")
fragment = lxml_cleaner.clean_html(fragment)
plugin_content = tostring(fragment, encoding="unicode")
if plugin_content.startswith("<div>"):
# still dont like lxml!
plugin_content = plugin_content[len("<div>") : -len("</div>")]
plugin_content = strip_tags(plugin_content)

return plugin_content
Expand Down