django-bleach

import os from django.db import models from django_bleach.models import BleachHTMLField # Configure settings (e.g., in settings.py or test setup) # You can also pass these directly to the field constructor # os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'your_project.settings') # os.environ['BLEACH_ALLOWED_TAGS'] = "['p', 'a', 'strong', 'em']" # os.environ['BLEACH_ALLOWED_ATTRIBUTES'] = "{'a': ['href', 'title']}" class Article(models.Model): title = models.CharField(max_length=200) # Use BleachHTMLField for content that might contain HTML content = BleachHTMLField( blank=True, null=True, # Field-specific allowed tags and attributes override global settings tags=['p', 'a', 'h1', 'h2', 'strong', 'em', 'img'], attributes={'a': ['href', 'title'], 'img': ['alt', 'src']}, strip_tags=False, # Do not strip tags not explicitly allowed (default is False) strip_comments=True # Strip HTML comments (default is True) ) def __str__(self): return self.title # Example usage (after creating and migrating the model): # article = Article.objects.create(title='My Article', content='<h1>Hello</h1><p>This is <strong>safe</strong> content.</p><script>alert("XSS!")</script>') # print(article.content) # Script tag should be removed.