flask-sanitize-escape

Flask-Sanitize-Escape 🛡️

A Flask middleware extension for automatic input sanitization, guarding against common web vulnerabilities like XSS, SQL injection, and other code injection attacks.

Key Features

• Effortless Integration: Works in the middleware
• Automatic Protection: Sanitizes incoming request data without requiring manual intervention in your route handlers.
• Comprehensive Coverage: Scrubs query parameters, form data, and JSON payloads.
• Targeted Defense: Neutralizes malicious code through HTML entity encoding and regex-based filtering.
• Customizable: Easily adapt the sanitization logic to your specific application's needs.
• Custom Escaping: Seamless custom escaping for specific characters as you need.

Installation

pip install flask-sanitize-escape

Usage

1. Activate Middleware:

from flask import Flask
from flask_sanitize_escape import SanitizeEscapeExtension  

app = Flask(__name__)

# Initialize the extension with options
sanitize_extension = SanitizeEscapeExtension(
    app, sanitize_quotes=True, custom_characters=["$", "#", "%"]
)

sanitize_extension.init_app(app) # Register the middleware

NOTE

It is suggested to use sanitize_quotes=True

2. Relax! Your application's input data is now automatically sanitized before it reaches your route handlers.

Example

@app.route('/submit', methods=['POST'])
def submit_data():
    data = g.sanitized_json  # accessing JSON from request.get_json()
    data = g.sanitized_args  # accessing arguments from request.args
    data = g.sanitized_form  # accessing values from request.form

    # Safely process the sanitized data...

Customization

Stay tune for upcoming version

Contributing

We welcome contributions! Feel free to open issues for bugs or feature requests, or submit pull requests with improvements.

License

This project is licensed under the MIT License - see the LICENSE file for details.