HTML Sanitization in Python/Django

For sanitizing HTML input in a Python/Django application, there are several approaches you can consider:

1. Bleach (with proper configuration)

Despite your issues with Bleach, it remains one of the most recommended tools for HTML sanitization in Python. The style stripping might be due to configuration issues:

PYTHONCopied
import bleach

# Configure allowed tags, attributes, and styles
allowed_tags = ['p', 'span', 'a', 'br', 'strong', 'em', 'ul', 'ol', 'li']
allowed_attrs = {
    '*': ['class', 'style'],
    'a': ['href', 'rel', 'target'],
}
allowed_styles = ['color', 'font-weight', 'text-align', 'margin', 'padding']

# Sanitize the HTML
sanitized_html = bleach.clean(
    html_input,
    tags=allowed_tags,
    attributes=allowed_attrs,
    styles=allowed_styles,
    strip=True
)

2. django-bleach

This is a Django-specific wrapper around Bleach that integrates well with Django forms and models:

PYTHONCopied
# settings.py
BLEACH_ALLOWED_TAGS = ['p', 'span', 'a', 'br', 'strong', 'em', 'ul', 'ol', 'li']
BLEACH_ALLOWED_ATTRIBUTES = {
    '*': ['class', 'style'],
    'a': ['href', 'rel', 'target'],
}
BLEACH_ALLOWED_STYLES = ['color', 'font-weight', 'text-align', 'margin', 'padding']

# In your model
from django_bleach.models import BleachField

class MyModel(models.Model):
    content = BleachField()

3. html-sanitizer

This is another option that might work better for your needs:

PYTHONCopied
from html_sanitizer import Sanitizer

sanitizer = Sanitizer({
    'tags': {'p', 'span', 'a', 'br', 'strong', 'em', 'ul', 'ol', 'li'},
    'attributes': {
        'a': ('href', 'rel', 'target'),
        '*': ('class', 'style'),
    },
    'styles': {'color', 'font-weight', 'text-align', 'margin', 'padding'},
})

sanitized_html = sanitizer.sanitize(html_input)

4. Custom solution with lxml

For more control, you can build a custom sanitizer using lxml:

PYTHONCopied
from lxml.html.clean import Cleaner

cleaner = Cleaner(
    allow_tags=['p', 'span', 'a', 'br', 'strong', 'em', 'ul', 'ol', 'li'],
    safe_attrs_only=True,
    safe_attrs={'href', 'rel', 'target', 'class', 'style'},
    style=True  # Don't remove styles
)

sanitized_html = cleaner.clean_html(html_input)

5. Django's strip_tags (limited)

For very simple cases where you just want to remove all HTML:

PYTHONCopied
from django.utils.html import strip_tags

text_only = strip_tags(html_input)

If you're specifically having issues with style attributes in Bleach, make sure you're using the latest version and that your configuration is correct. The styles parameter needs to be properly set to allow specific CSS properties.