django-safe-template-engine 1.0.0__py3-none-any.whl

django_safe_template_engine/engine.py

@@ -0,0 +1,16 @@
+from django.template.engine import Engine
+
+
+class SafeTemplateEngine(Engine):
+
+    def __init__(self, **kwargs):
+        self.default_builtins = [
+            'django_safe_template_engine.trusted_filters',
+            'django_safe_template_engine.trusted_tags',
+        ]
+
+        super().__init__(**kwargs)
+
+        self.dirs = []
+        self.app_dirs = False
+        self.loaders = []

django_safe_template_engine/trusted_filters.py

@@ -0,0 +1,72 @@
+from django.template.defaultfilters import (
+    add, addslashes, capfirst, center, cut, date, default, default_if_none,
+    dictsort, dictsortreversed, divisibleby, escape_filter, escapejs_filter,
+    filesizeformat, first, floatformat, force_escape, get_digit, iriencode,
+    join, json_script, last, length, length_is, linebreaks_filter,
+    linebreaksbr, linenumbers, ljust, lower, make_list, phone2numeric_filter,
+    pluralize, random, rjust, safe, safeseq, slice_filter, slugify,
+    stringformat, striptags, time, timesince_filter, timeuntil_filter, title,
+    truncatechars, truncatechars_html, truncatewords, truncatewords_html,
+    unordered_list, upper, urlencode, urlize, urlizetrunc, wordcount, wordwrap,
+    yesno,
+)
+from django.template.library import Library
+
+register = Library()
+
+register.filter(addslashes, is_safe=True)
+register.filter(capfirst, is_safe=True)
+register.filter('escapejs', escapejs_filter)
+register.filter(json_script, is_safe=True)
+register.filter(floatformat, is_safe=True)
+register.filter(iriencode, is_safe=True)
+register.filter(linenumbers, is_safe=True, needs_autoescape=True)
+register.filter(lower, is_safe=True)
+register.filter(make_list, is_safe=False)
+register.filter(slugify, is_safe=True)
+register.filter(stringformat, is_safe=True)
+register.filter(title, is_safe=True)
+register.filter(truncatechars, is_safe=True)
+register.filter(truncatechars_html, is_safe=True)
+register.filter(truncatewords, is_safe=True)
+register.filter(truncatewords_html, is_safe=True)
+register.filter(upper, is_safe=False)
+register.filter(urlencode, is_safe=False)
+register.filter(urlize, is_safe=True, needs_autoescape=True)
+register.filter(urlizetrunc, is_safe=True, needs_autoescape=True)
+register.filter(wordcount, is_safe=False)
+register.filter(wordwrap, is_safe=True)
+register.filter(ljust, is_safe=True)
+register.filter(rjust, is_safe=True)
+register.filter(center, is_safe=True)
+register.filter(cut)
+register.filter('escape', escape_filter, is_safe=True)
+register.filter(force_escape, is_safe=True)
+register.filter('linebreaks', linebreaks_filter, is_safe=True, needs_autoescape=True)
+register.filter(linebreaksbr, is_safe=True, needs_autoescape=True)
+register.filter(safe, is_safe=True)
+register.filter(safeseq, is_safe=True)
+register.filter(striptags, is_safe=True)
+register.filter(dictsort, is_safe=False)
+register.filter(dictsortreversed, is_safe=False)
+register.filter(first, is_safe=False)
+register.filter(join, is_safe=True, needs_autoescape=True)
+register.filter(last, is_safe=True)
+register.filter(length, is_safe=False)
+register.filter(length_is, is_safe=False)
+register.filter(random, is_safe=True)
+register.filter('slice', slice_filter, is_safe=True)
+register.filter(unordered_list, is_safe=True, needs_autoescape=True)
+register.filter(add, is_safe=False)
+register.filter(get_digit, is_safe=False)
+register.filter(date, expects_localtime=True, is_safe=False)
+register.filter(time, expects_localtime=True, is_safe=False)
+register.filter('timesince', timesince_filter, is_safe=False)
+register.filter('timeuntil', timeuntil_filter, is_safe=False)
+register.filter(default, is_safe=False)
+register.filter(default_if_none, is_safe=False)
+register.filter(divisibleby, is_safe=False)
+register.filter(yesno, is_safe=False)
+register.filter(filesizeformat, is_safe=True)
+register.filter(pluralize, is_safe=False)
+register.filter('phone2numeric', phone2numeric_filter, is_safe=True)

django_safe_template_engine/trusted_tags.py

@@ -0,0 +1,27 @@
+from django.template.defaulttags import (
+    autoescape, comment, cycle, do_filter, do_for, do_if, do_with, firstof,
+    ifchanged, lorem, now, regroup, resetcycle, spaceless, templatetag, url,
+    verbatim, widthratio,
+)
+from django.template.library import Library
+
+register = Library()
+
+register.tag(autoescape)
+register.tag(comment)
+register.tag(cycle)
+register.tag('filter', do_filter)
+register.tag(firstof)
+register.tag('for', do_for)
+register.tag('if', do_if)
+register.tag(ifchanged)
+register.tag(lorem)
+register.tag(now)
+register.tag(regroup)
+register.tag(resetcycle)
+register.tag(spaceless)
+register.tag(templatetag)
+register.tag(url)
+register.tag(verbatim)
+register.tag(widthratio)
+register.tag('with', do_with)

django_safe_template_engine/validators.py

@@ -0,0 +1,11 @@
+from django.core.exceptions import ValidationError
+from django.template import Template, TemplateSyntaxError
+
+from django_safe_template_engine.engine import SafeTemplateEngine
+
+
+def validate_safe_engine_template_syntax(source):
+    try:
+        Template(source, engine=SafeTemplateEngine())
+    except (TemplateSyntaxError) as err:
+        raise ValidationError(str(err))

django_safe_template_engine-1.0.0.dist-info/METADATA

@@ -0,0 +1,166 @@
+Metadata-Version: 2.3
+Name: django_safe_template_engine
+Version: 1.0.0
+Summary: A Django template engine to render untrusted template code
+Project-URL: Homepage, https://github.com/ronanboiteau/django_safe_template_engine
+Project-URL: Documentation, https://github.com/ronanboiteau/django_safe_template_engine/blob/main/README.md
+Project-URL: Repository, https://github.com/ronanboiteau/django_safe_template_engine.git
+Project-URL: Issues, https://github.com/ronanboiteau/django_safe_template_engine/issues
+Project-URL: Changelog, https://github.com/ronanboiteau/django_safe_template_engine/blob/main/CHANGELOG.md
+Author-email: Ronan Boiteau <ronan@boiteau.eu>
+Maintainer-email: Ronan Boiteau <ronan@boiteau.eu>
+License: BSD 3-Clause License
+        
+        Copyright (c) 2023, GuestReady
+        
+        Redistribution and use in source and binary forms, with or without
+        modification, are permitted provided that the following conditions are met:
+        
+        1. Redistributions of source code must retain the above copyright notice, this
+           list of conditions and the following disclaimer.
+        
+        2. Redistributions in binary form must reproduce the above copyright notice,
+           this list of conditions and the following disclaimer in the documentation
+           and/or other materials provided with the distribution.
+        
+        3. Neither the name of the copyright holder nor the names of its
+           contributors may be used to endorse or promote products derived from
+           this software without specific prior written permission.
+        
+        THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+        AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+        IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+        DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+        FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+        DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+        SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+        CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+        OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+        OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+License-File: LICENSE
+Keywords: django,engine,safe,template
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.8
+Requires-Dist: django<3.1,>=3
+Description-Content-Type: text/markdown
+
+![GitHub Actions build status](https://github.com/guestready/django_safe_template_engine/actions/workflows/build.yml/badge.svg?branch=main)
+
+# Django Safe Template Engine
+
+Django template engine to render untrusted template code
+
+## Requirements
+
+- Python 3.8 to 3.11
+- Django 3.0
+
+## Available tools
+
+Template engine:
+
+```py
+from django.template import Template
+from django_safe_template_engine.engine import SafeTemplateEngine
+
+safe_engine = SafeTemplateEngine()
+Template(source, engine=safe_engine)
+```
+
+Validator:
+
+```py
+from django_safe_template_engine.validators import validate_safe_engine_template_syntax
+
+template_code = '{% include "hacked.html" %}'
+validate_safe_engine_template_syntax(template_code)
+```
+
+## Trusted built-ins
+
+The following tags and filters are allowed by this template engine.
+
+### Trusted tags
+
+- [`autoescape`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#autoescape)
+- [`comment`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#comment)
+- [`cycle`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#cycle)
+- [`filter`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#filter)
+- [`firstof`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#firstof)
+- [`for`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#for)
+- [`for … empty`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#for-empty)
+- [`if`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#if)
+- [`ifchanged`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#ifchanged)
+- [`lorem`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#lorem)
+- [`now`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#now)
+- [`regroup`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#regroup)
+- [`resetcycle`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#resetcycle)
+- [`spaceless`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#spaceless)
+- [`templatetag`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#templatetag)
+- [`url`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#url)
+- [`verbatim`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#verbatim)
+- [`widthratio`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#widthratio)
+- [`with`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#with)
+
+### Trusted filters
+
+<!-- TODO: Check for dead links -->
+<!-- TODO: Re-order? -->
+- [`addslashes`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#addslashes)
+- [`capfirst`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#capfirst)
+- [`escapejs`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#escapejs)
+- [`json_script`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#json_script)
+- [`floatformat`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#floatformat)
+- [`iriencode`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#iriencode)
+- [`linenumbers`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#linenumbers)
+- [`lower`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#lower)
+- [`make_list`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#make_list)
+- [`slugify`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#slugify)
+- [`stringformat`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#stringformat)
+- [`title`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#title)
+- [`truncatechars`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#truncatechars)
+- [`truncatechars_html`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#truncatechars_html)
+- [`truncatewords`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#truncatewords)
+- [`truncatewords_html`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#truncatewords_html)
+- [`upper`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#upper)
+- [`urlencode`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#urlencode)
+- [`urlize`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#urlize)
+- [`urlizetrunc`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#urlizetrunc)
+- [`wordcount`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#wordcount)
+- [`wordwrap`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#wordwrap)
+- [`ljust`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#ljust)
+- [`rjust`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#rjust)
+- [`center`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#center)
+- [`cut`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#cut)
+- [`escape`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#escape)
+- [`force_escape`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#force_escape)
+- [`linebreaks`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#linebreaks)
+- [`linebreaksbr`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#linebreaksbr)
+- [`safe`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#safe)
+- [`safeseq`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#safeseq)
+- [`striptags`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#striptags)
+- [`dictsort`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#dictsort)
+- [`dictsortreversed`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#dictsortreversed)
+- [`first`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#first)
+- [`join`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#join)
+- [`last`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#last)
+- [`length`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#length)
+- [`length_is`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#length_is)
+- [`random`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#random)
+- [`slice`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#slice)
+- [`unordered_list`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#unordered_list)
+- [`add`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#add)
+- [`get_digit`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#get_digit)
+- [`date`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#date)
+- [`time`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#time)
+- [`timesince`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#timesince)
+- [`timeuntil`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#timeuntil)
+- [`default`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#default)
+- [`default_if_none`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#default_if_none)
+- [`divisibleby`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#divisibleby)
+- [`yesno`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#yesno)
+- [`filesizeformat`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#filesizeformat)
+- [`pluralize`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#pluralize)
+- [`phone2numeric`](https://docs.djangoproject.com/en/dev/ref/templates/builtins/#phone2numeric)

django_safe_template_engine-1.0.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+django_safe_template_engine/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+django_safe_template_engine/engine.py,sha256=2THW686FAjzkQGh7QAu1zWuzoPFySRofeIuS3RK0y5M,388
+django_safe_template_engine/trusted_filters.py,sha256=sT_9cwdg4ot8TQ0Ghdyolfb-MPVTsbvk3VVV-hYeVsU,3413
+django_safe_template_engine/trusted_tags.py,sha256=VFtyZTUo1EB1LvcrM1ycPN8xKgXu4XyBAlkODUoYjoo,722
+django_safe_template_engine/validators.py,sha256=SYima2sJ3PvULQ7MdPZ03tuXFzKB1hx6uxMWZ3YQgVQ,372
+django_safe_template_engine-1.0.0.dist-info/METADATA,sha256=ESMb4gWlOcRodfq2N_8ChlLwJPsFTXyYKFe5eoJRBoY,10196
+django_safe_template_engine-1.0.0.dist-info/WHEEL,sha256=K0BPUNF1N3kQ9olb8aVEtkObePEjdr2JOLT1N83EVws,87
+django_safe_template_engine-1.0.0.dist-info/licenses/LICENSE,sha256=oyFQJQVffHM_hYM8U0pjee7NGRzEcE8a_pagH6EvKQc,1497
+django_safe_template_engine-1.0.0.dist-info/RECORD,,

django_safe_template_engine-1.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.24.0
+Root-Is-Purelib: true
+Tag: py3-none-any

django_safe_template_engine-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2023, GuestReady
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.