Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This package renamed as "drf-extra-fields", earlier it was named as django-extra-fields. New versions can be tracked from here.
Extra Fields for Django Rest Framework
Install the package
pip install django-extra-fields
Note:
An image representation for Base64ImageField
Inherited from ImageField
Signature: Base64ImageField()
data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7
R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7
represent_in_base64
(False
by default), if set to True
it will allow for base64-encoded downloads of an ImageField
.Base64ImageField
class and set allowed extensions (ALLOWED_TYPES
list), or customize the validation messages (INVALID_FILE_MESSAGE
, INVALID_TYPE_MESSAGE
)Example:
# serializer
from drf_extra_fields.fields import Base64ImageField
class UploadedBase64ImageSerializer(serializers.Serializer):
file = Base64ImageField(required=False)
created = serializers.DateTimeField()
# use the serializer
file = 'R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=='
serializer = UploadedBase64ImageSerializer(data={'created': now, 'file': file})
A file representation for Base64FileField
Inherited from FileField
Signature: Base64FileField()
get_file_extension
method and set ALLOWED_TYPES
list.Example:
class PDFBase64File(Base64FileField):
ALLOWED_TYPES = ['pdf']
def get_file_extension(self, filename, decoded_file):
try:
PyPDF2.PdfFileReader(io.BytesIO(decoded_file))
except PyPDF2.utils.PdfReadError as e:
logger.warning(e)
else:
return 'pdf'
Point field for GeoDjango
Signature: PointField()
It takes a dictionary contains latitude and longitude keys like below
{ "latitude": 49.8782482189424, "longitude": 24.452545489 }
It takes the optional parameter str_points
(False by default), if set to True it serializes the longitude/latitude
values as strings
It takes the optional parameter srid
(None by default), if set the Point created object will have its srid attribute set to the same value.
Example:
# serializer
from drf_extra_fields.geo_fields import PointField
class PointFieldSerializer(serializers.Serializer):
point = PointField(required=False)
created = serializers.DateTimeField()
# use the serializer
point = {
"latitude": 49.8782482189424,
"longitude": 24.452545489
}
serializer = PointFieldSerializer(data={'created': now, 'point': point})
from rest_framework import serializers
from drf_extra_fields.fields import IntegerRangeField
class RangeSerializer(serializers.Serializer):
ranges = IntegerRangeField()
serializer = RangeSerializer(data={'ranges': {'lower': 0, 'upper': 1}})
from rest_framework import serializers
from drf_extra_fields.fields import FloatRangeField
class RangeSerializer(serializers.Serializer):
ranges = FloatRangeField()
serializer = RangeSerializer(data={'ranges': {'lower': 0., 'upper': 1.}})
from rest_framework import serializers
from drf_extra_fields.fields import DecimalRangeField
class RangeSerializer(serializers.Serializer):
ranges = DecimalRangeField()
serializer = RangeSerializer(data={'ranges': {'lower': 0., 'upper': 1.}}, )
import datetime
from rest_framework import serializers
from drf_extra_fields.fields import DateRangeField
class RangeSerializer(serializers.Serializer):
ranges = DateRangeField()
serializer = RangeSerializer(data={'ranges': {'lower': datetime.date(2015, 1, 1), 'upper': datetime.date(2015, 2, 1)}})
import datetime
from rest_framework import serializers
from drf_extra_fields.fields import DateTimeRangeField
class RangeSerializer(serializers.Serializer):
ranges = DateTimeRangeField()
serializer = RangeSerializer(data={'ranges': {'lower': datetime.datetime(2015, 1, 1, 0), 'upper': datetime.datetime(2015, 2, 1, 0)}})
Represents related object with a serializer.
presentation_serializer
could also be a string that represents a dotted path of a serializer, this is useful when you want to represent a related field with the same serializer.
from drf_extra_fields.relations import PresentablePrimaryKeyRelatedField
class UserSerializer(serializers.ModelSerializer):
class Meta:
model = User
fields = (
'id',
"username",
)
class PostSerializer(serializers.ModelSerializer):
user = PresentablePrimaryKeyRelatedField(
queryset=User.objects.all(),
presentation_serializer=UserSerializer,
presentation_serializer_kwargs={
'example': [
'of',
'passing',
'kwargs',
'to',
'serializer',
]
},
read_source=None
)
class Meta:
model = Post
fields = (
"id",
"title",
"user",
)
Serializer data:
{
"user": 1,
"title": "test"
}
Serialized data with PrimaryKeyRelatedField:
{
"id":1,
"user": 1,
"title": "test"
}
Serialized data with PresentablePrimaryKeyRelatedField:
{
"id":1,
"user": {
"id": 1,
"username": "test"
},
"title": "test"
}
Represents related object retrieved using slug with a serializer.
from drf_extra_fields.relations import PresentableSlugRelatedField
class CategorySerializer(serializers.ModelSerializer):
class Meta:
model = Category
fields = (
"id",
"slug",
"name"
)
class ProductSerializer(serializers.ModelSerializer):
category = PresentableSlugRelatedField(
slug_field="slug",
queryset=Category.objects.all(),
presentation_serializer=CategorySerializer,
presentation_serializer_kwargs={
'example': [
'of',
'passing',
'kwargs',
'to',
'serializer',
]
},
read_source=None
)
class Meta:
model = Product
fields = (
"id",
"name",
"category",
)
Serializer data:
{
"category": "vegetables",
"name": "Tomato"
}
Serialized data with SlugRelatedField:
{
"id": 1,
"name": "Tomato",
"category": "vegetables"
}
Serialized data with PresentableSlugRelatedField:
{
"id": 1,
"name": "Tomato",
"category": {
"id": 1,
"slug": "vegetables",
"name": "Vegetables"
}
}
This parameter allows you to use different source
for read operations and doesn't change field name for write operations. This is only used while representing the data.
A django-rest-framework field for handling image-uploads through raw post data, with a fallback to multipart form data.
It first tries Base64ImageField. if it fails then tries ImageField.
from rest_framework import serializers
from drf_extra_fields.fields import HybridImageField
class HybridImageSerializer(serializers.Serializer):
image = HybridImageField()
The drf-yasg project seems to generate wrong documentation on Base64ImageField or Base64FileField. It marks those fields as readonly. Here is the workaround code for correct the generated document. (More detail on issue #66)
class PDFBase64FileField(Base64FileField):
ALLOWED_TYPES = ['pdf']
class Meta:
swagger_schema_fields = {
'type': 'string',
'title': 'File Content',
'description': 'Content of the file base64 encoded',
'read_only': False # <-- FIX
}
def get_file_extension(self, filename, decoded_file):
try:
PyPDF2.PdfFileReader(io.BytesIO(decoded_file))
except PyPDF2.utils.PdfReadError as e:
logger.warning(e)
else:
return 'pdf'
An enhancement over django-rest-framework's EmailField to allow case-insensitive serialization and deserialization of e-mail addresses.
from rest_framework import serializers
from drf_extra_fields.fields import LowercaseEmailField
class EmailSerializer(serializers.Serializer):
email = LowercaseEmailField()
TESTS
$ pip install tox # if not already installed
$ tox
Or, if you prefer using Docker (recommended):
docker build -t drf_extra_fields .
docker run -v $(pwd):/app -it drf_extra_fields /bin/bash
tox
README
Copyright DRF EXTRA FIELDS HIPO
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
FAQs
Additional fields for Django Rest Framework.
We found that django-extra-fields demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.