Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Simple, elegant HTML, XHTML and XML generation.
To construct HTML start with an instance of html.HTML()
. Add
tags by accessing the tag's attribute on that object. For example:
from html import HTML h = HTML() h.p('Hello, world!') print h # or print(h) in python 3+
Hello, world!
You may supply a tag name and some text contents when creating a HTML instance:
texth = HTML('html', 'text') print h
You may also append text content later using the tag's .text()
method
or using augmented addition +=
. Any HTML-specific characters (<>&"
)
in the text will be escaped for HTML safety as appropriate unless
escape=False
is passed. Each of the following examples uses a new
HTML
instance:
p = h.p('hello world!\n') p.br p.text('more → text', escape=False) p += ' ... augmented' h.p print h
hello, world!
more → text ... augmented
Note also that the top-level HTML
object adds newlines between tags by
default. Finally in the above you'll see an empty paragraph tag - tags with
no contents get no closing tag.
If the tag should have sub-tags you have two options. You may either add the sub-tags directly on the tag:
l = h.ol l.li('item 1') l.li.b('item 2 > 1') print h
Note that the default behavior with lists (and tables) is to add newlines
between sub-tags to generate a nicer output. You can also see in that
example the chaining of tags in l.li.b
.
Tag attributes may be passed in as well:
t = h.table(border='1') for i in range(2): r = t.tr r.td('column 1') r.td('column 2') print t
column 1 | column 2 |
column 1 | column 2 |
A variation on the above is to use a tag as a context variable. The following is functionally identical to the first list construction but with a slightly different sytax emphasising the HTML structure:
with h.ol as l: ... l.li('item 1') ... l.li.b('item 2 > 1')
You may turn off/on adding newlines by passing newlines=False
or
True
to the tag (or HTML
instance) at creation time:
l = h.ol(newlines=False) l.li('item 1') l.li('item 2') print h
Since we can't use class
as a keyword, the library recognises klass
as a substitute:
print h.p(content, klass="styled")
content
HTML
will work with either regular strings or unicode strings, but
not both at the same time.
Obtain the final unicode string by calling unicode()
on the HTML
instance:
h = HTML() h.p(u'Some Euro: €1.14') unicode(h) u'
Some Euro: €1.14
'
If (under Python 2.x) you add non-unicode strings or attempt to get the
resultant HTML source through any means other than unicode()
then you
will most likely get one of the following errors raised:
UnicodeDecodeError
Probably means you've added non-unicode strings to your HTML.
UnicodeEncodeError
Probably means you're trying to get the resultant HTML using print
or str()
(or %s
).
The HTML document is generated when the HTML
instance is "stringified".
This could be done either by invoking str()
on it, or just printing it.
It may also be returned directly as the "iterable content" from a WSGI app
function.
You may also render any tag or sub-tag at any time by stringifying it.
Tags with no contents (either text or sub-tags) will have no closing tag. There is no "special list" of tags that must always have closing tags, so if you need to force a closing tag you'll need to provide some content, even if it's just a single space character.
Rendering doesn't affect the HTML document's state, so you can add to or otherwise manipulate the HTML after you've stringified it.
To construct XHTML start with an instance of html.XHTML()
and use it
as you would an HTML
instance. Empty elements will now be rendered
with the appropriate XHTML minimized tag syntax. For example:
from html import XHTML h = XHTML() h.p h.br print h
A slight tweak to the html.XHTML()
implementation allows us to generate
arbitrary XML using html.XML()
:
from html import XML h = XML('xml') h.p h.br('hi there') print h
hi there
If your tag name isn't a valid Python identifier name, or if it's called "text" or "raw_text" you can add your tag slightly more manually:
from html import XML h = XML('xml') h += XML('some-tag', 'some text') h += XML('text', 'some text') print h
some text some text
I would be interested to know whether this module is useful - if you use it please indicate so at https://www.ohloh.net/p/pyhtml
This code is copyright 2009-2011 eKit.com Inc (http://www.ekit.com/) See the end of the source file for the license of use. XHTML support was contributed by Michael Haubenwallner.
FAQs
simple, elegant HTML, XHTML and XML generation
We found that html demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.