Add HTML sanitization code

[Aaron Swartz]

The HTML sanitization code at http://www.aaronsw.com/2002/sanitize/ (and possibly the other code there) should be integrated into web.py, perhaps after we get some approval of its sanity by someone.

[Anand Chitipothu (anandology)]

How is this related to web.py?

On 30-May-07, at 9:24 PM, Aaron Swartz wrote:

> Public bug reported:
>
> The HTML sanitization code at http://www.aaronsw.com/2002/sanitize/
> (and
> possibly the other code there) should be integrated into web.py,
> perhaps
> after we get some approval of its sanity by someone.
>
> ** Affects: webpy (upstream)
> Importance: Undecided
> Status: Unconfirmed
>
> --
> Add HTML sanitization code
> https://bugs.launchpad.net/bugs/117784
> You received this bug notification because you are a member of Web.py
> Administrators, which is the registrant for web.py.

[Eleanor Berger (intellectronica)]

> How is this related to web.py?

Actually, it makes sense - many web applications have 'user-contributed' parts, and they always require this sort of facility.

[huntercross (hunter-ponticlaro)]

i agree we need sanitation / filtering for all user input built-in to web.py. i added a bug report here: https://bugs.launchpad.net/webpy/+bug/179962 that includes another approach to this that could be used in conjunction with aaron's sanitize code. i attached that code to this bug as well.

[Aaron Swartz (aaronsw)]

taking off 0.3.

[Anand Chitipothu (anandology)]

Genshi has very elegant support for filtering and sanitizing html.

http://genshi.edgewall.org/wiki/Documentation/filters.html

Here is some code that I use for sanitizing user pages in Open Library.

def sanitize(html)
    stream = genshi.HTML(html) | genshi.filters.HTMLSanitizer() | genshi.filters.Transformer("a").attr("rel", "nofollow")
    return stream.render()

Should we just point people to use Genshi for doing sanitization instead of adding something to web.py?