You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
120 lines
2.1 KiB
Python
120 lines
2.1 KiB
Python
import bleach
|
|
from bleach.css_sanitizer import CSSSanitizer
|
|
|
|
ALLOWED_TAGS = [
|
|
"a",
|
|
"abbr",
|
|
"acronym",
|
|
"b",
|
|
"blockquote",
|
|
"br",
|
|
"code",
|
|
"col",
|
|
"colgroup",
|
|
"dd",
|
|
"del",
|
|
"dl",
|
|
"dt",
|
|
"em",
|
|
"h1",
|
|
"h2",
|
|
"h3",
|
|
"h4",
|
|
"h5",
|
|
"h6",
|
|
"hr",
|
|
"i",
|
|
"img",
|
|
"li",
|
|
"ol",
|
|
"p",
|
|
"pre",
|
|
"s",
|
|
"span",
|
|
"strike",
|
|
"strong",
|
|
"sub",
|
|
"sup",
|
|
"table",
|
|
"tbody",
|
|
"td",
|
|
"tfoot",
|
|
"th",
|
|
"thead",
|
|
"tr",
|
|
"tt",
|
|
"u",
|
|
"ul",
|
|
"video",
|
|
"source",
|
|
"div",
|
|
"font",
|
|
]
|
|
|
|
ALLOWED_ATTRIBUTES = {
|
|
"*": ["class", "style", "id", "data-*"],
|
|
"a": ["href", "title", "target", "rel"],
|
|
"abbr": ["title"],
|
|
"acronym": ["title"],
|
|
"img": ["src", "alt", "title", "width", "height"],
|
|
"video": ["src", "controls", "width", "height", "poster"],
|
|
"source": ["src", "type"],
|
|
"font": ["color", "size", "face"],
|
|
"td": ["width", "height", "colspan", "rowspan"],
|
|
"th": ["width", "height", "colspan", "rowspan"],
|
|
"col": ["width", "span"],
|
|
"colgroup": ["span"],
|
|
}
|
|
|
|
ALLOWED_STYLES = [
|
|
"color",
|
|
"background-color",
|
|
"font-size",
|
|
"font-family",
|
|
"font-weight",
|
|
"font-style",
|
|
"text-decoration",
|
|
"text-align",
|
|
"margin",
|
|
"margin-left",
|
|
"margin-right",
|
|
"margin-top",
|
|
"margin-bottom",
|
|
"padding",
|
|
"padding-left",
|
|
"padding-right",
|
|
"padding-top",
|
|
"padding-bottom",
|
|
"border",
|
|
"border-color",
|
|
"border-width",
|
|
"border-style",
|
|
"width",
|
|
"height",
|
|
"line-height",
|
|
"display",
|
|
]
|
|
|
|
|
|
def sanitize_html(content: str) -> str:
|
|
"""
|
|
清理 HTML 内容，移除潜在的 XSS 攻击代码。
|
|
|
|
参数:
|
|
- content (str): 需要清理的 HTML 内容
|
|
|
|
返回:
|
|
- str: 清理后的安全 HTML 内容
|
|
"""
|
|
if not content:
|
|
return content
|
|
|
|
return bleach.clean(
|
|
content,
|
|
tags=ALLOWED_TAGS,
|
|
attributes=ALLOWED_ATTRIBUTES,
|
|
css_sanitizer=CSSSanitizer(allowed_css_properties=ALLOWED_STYLES),
|
|
strip=True,
|
|
strip_comments=True,
|
|
)
|