A lightweight collection of JSON helpers for Django.
Project description
A lightweight collection of JSON helpers for Django. Includes a template filter for safely outputting JSON, views that encode and decode JSON, and a helper for writing simple REST views.
A special JSON encoder is used to serialize QuerySets and objects with to_json methods.
Filter
You can serialize an object in JSON using the |json filter. This is useful to generate safe JavaScript:
{% load argonauts %}
<script type="application/javascript">
(function (document) {
var object_list = {{ object_list|json }};
var list = document.createElement("ul");
for (var i in object_list) {
if (object_list.hasOwnProperty(i)) {
var item = document.createElement("li");
item.appendChild(document.createTextNode(object_list[i]);
list.appendChild(item);
}
}
document.body.appendChild(list);
})(document);
</script>|json is safe to use anywhere in XML or XHTML except in an attribute. It’s import to use this tag rather than dumping the output of json.dumps into HTML, because an attacker could output a closing tag and effect an XSS attack. For example, if we output json.dumps("</script><script>console.log('xss'); //") in template like this:
<script>
var somedata = {{ somedata_as_json }};
</script>We get:
<script>
var somedata = "</script>
<script>
console.log('xss'); //";
</script>This allows the attacker to inject their own JavaScript. The |json tag prevents this by encoding the closing </script> tag with JSON’s unicode escapes.
Views
JsonResponseMixin
JsonResponseMixin implements render_to_response method that serializes an object into a JSON response. Thus it is compatible with generic Django views:
from django.db import models
from django.views.generic.detail import BaseDetailView
from argonauts.views import JsonResponseMixin
class Blog(models.Model):
title = models.CharField(max_length=255)
body = models.TextField()
def to_json(self):
return {
'title': self.title,
'body': self.body,
}
class BlogDetailView(JsonResponseMixin, BaseDetailView):
"""
Detail view returning object serialized in JSON
"""
model = BlogJsonRequestMixin
JsonRequestMixin gives access to the request data through data() method.
from django.views.generic.base import View
from argonauts.views import JsonRequestMixin:
from argonauts.http import JsonResponse
class EchoView(JsonRequestMixin, View):
def dispatch(self, *args, **kwargs):
return JsonResponse(self.data())RestView
RestView is an abstract class. Subclasses should implement auth(), for handling authentication, and at least one HTTP method.
RestView implements OPTIONS http method, and inherits from JsonRequestMixin and JsonResponseMixin.
from django.core.exceptions import PermissionDenied
from argonauts.views import RestView
from .utils import get_action
class CrazyRestView(RestView):
def auth(self, *args, **kwargs):
if not self.request.user.is_superuser:
raise PermissionDenied
def post(self, *args, **kwargs):
action = kwargs.pop('action')
action_func = get_action(action)
return self.render_to_response(action_func(self.data()))
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
File details
Details for the file django-argonauts-1.0.0.tar.gz.
File metadata
- Download URL: django-argonauts-1.0.0.tar.gz
- Upload date:
- Size: 7.1 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | fc8efe3e2d09374938c575bc3990288eed1b7ec40d8bf8762ab77a82bdb75bea |
|
| MD5 | 14397e132f7e97eae4fe6cc8de2a29ee |
|
| BLAKE2b-256 | 922a09936c8e0b287ca8ad2485a152af67ccdfd4a0a2481f1e9e2577cc18d1f3 |
