django xss 필터

django가 xss에 대한 필터는 그 자체가 가지고 있는safe 등이 있습니다
그러나 jsonResponse 반환을 통해 다시 앞에 불러오면 XSS를 효과적으로 필터할 수 없습니다.
따라서 리퀘스트의 GET POST 함수의 반환 값을 장식기로 필터할 XSS 필터를 직접 작성해야 합니다.
이 필터 함수는 json list 문자열 등을 필터링하여 render, Http Response, Json Response에 사용할 수 있습니다.

import json

def jsonXssFilter(data):
    payloads = {
        '\'':''',
        '"':'"',
        '<':'<',
        '>':'>'
    }
    if type(data) == dict:
        new = {}
        for key,values in data.items():
            new[key] = jsonXssFilter(values)
    elif type(data) == list:
        new = []
        for i in data:
            new.append(jsonXssFilter(i))
    elif type(data) == int or type(data) == float:
        new = data
    elif type(data) == str:
        new = data
        for key,value in payloads.items():
            new = new.replace(key,value)
    elif type(data) ==bytes:
        new = data
    else:
        print('>>> unknown type:')
        print(type(data))
        new = data
    return new

def xssfilter(func):
    def wrapper(*args, **kwargs):
        result = func(*args, **kwargs)
        result.content = result.content
        try:
            jsondata = json.loads(result.content)
            result.content = json.dumps(jsonXssFilter(jsondata))
        except:
            result.content = jsonXssFilter(result.content)
        return result
    return wrapper

 
demo는 GET POST 함수의 데코레이터로서 다음과 같습니다.

class PermissionListView(LoginRequiredMixin, generic.TemplateView):
    """    """
    def dispatch(self, request, *args, **kwargs):
        return super(PermissionListView, self).dispatch(request, *args, **kwargs)
    @xssfilter
    def get(self, request, *args, **kwargs):
        if not user_has_permission(str(request.user),'permission_list'):
            return render(request, "blank.html")
        return render(request, 'user_manage/permission.html', locals())

    @xssfilter
    def post(self, request, *args, **kwargs):
        if request.is_ajax():
            self.post_data = request.POST
            dics = {
                "listPermission":{'op_fun':self.list_permission,'perm':'permission_list'},
                "addPermission":{'op_fun':self.add_permission,'perm':'permission_operate'},
                "delPermission":{'op_fun':self.del_permission,'perm':'permission_operate'}
            }
            operation=self.post_data.get("operation","")
            if not user_has_permission(str(request.user),dics[operation]['perm']):
                response = {'state':'false','message':'    ， %s  '%(dics[operation]['perm'])}
                return JsonResponse(response)
            data = dics[operation]['op_fun']()
            if not data:
                data = {}
            data['state'] = 'success'
            return JsonResponse(data=data)
    def list_permission(self):
        return {'permissions':search_all_permission()}
    def add_permission(self):
        permission_name = self.post_data['permissionName']
        permission_codename = self.post_data['permissionCodename']
        add_permission(name=permission_name,codename=permission_codename)
    def del_permission(self):
        del_permission(permissionid=self.post_data['permissionid'])

 
전재 대상:https://www.cnblogs.com/huim/p/9830760.html