v2ex/babel/ext/bleach/sanitizer.py
def sanitize_token(self, token):
        """Sanitize a token either by HTML-encoding or dropping.

        Unlike HTMLSanitizerMixin.sanitize_token, allowed_attributes can be
        a dict of {'tag': ['attribute', 'pairs'], 'tag': callable}.

        Here callable is a function with two arguments of attribute name
        and value. It should return true of false.

        Also gives the option to strip tags instead of encoding.

        """
        if (getattr(self, 'wildcard_attributes', None) is None and
            isinstance(self.allowed_attributes, dict)):
            self.wildcard_attributes = self.allowed_attributes.get('*', [])

        if token['type'] in (tokenTypes['StartTag'], tokenTypes['EndTag'],
                             tokenTypes['EmptyTag']):
            if token['name'] in self.allowed_elements:
                if 'data' in token:
                    if isinstance(self.allowed_attributes, dict):
                        allowed_attributes = self.allowed_attributes.get(
                            token['name'], [])
                        if not callable(allowed_attributes):
                            allowed_attributes += self.wildcard_attributes
                    else:
                        allowed_attributes = self.allowed_attributes
                    attrs = dict([(name, val) for name, val in
                                  token['data'][::-1]
                                  if (allowed_attributes(name, val)
                                      if callable(allowed_attributes)
                                      else name in allowed_attributes)])
                    for attr in self.attr_val_is_uri:
                        if not attr in attrs:
                            continue
                        val_unescaped = re.sub("[`\000-\040\177-\240\s]+", '',
                                               unescape(attrs[attr])).lower()
                        # Remove replacement characters from unescaped
                        # characters.
                        val_unescaped = val_unescaped.replace(u"\ufffd", "")
                        if (re.match(r'^[a-z0-9][-+.a-z0-9]*:', val_unescaped)
                            and (val_unescaped.split(':')[0] not in
                                 self.allowed_protocols)):
                            del attrs[attr]
                    for attr in self.svg_attr_val_allows_ref:
                        if attr in attrs:
                            attrs[attr] = re.sub(r'url\s*\(\s*[^#\s][^)]+?\)',
                                                 ' ',
                                                 unescape(attrs[attr]))
                    if (token['name'] in self.svg_allow_local_href and
                        'xlink:href' in attrs and
                        re.search(r'^\s*[^#\s].*', attrs['xlink:href'])):
                        del attrs['xlink:href']
                    if 'style' in attrs:
                        attrs['style'] = self.sanitize_css(attrs['style'])
                    token['data'] = [(name, val) for name, val in
                                     attrs.items()]
                return token
            elif self.strip_disallowed_elements:
                pass
            else:
                if token['type'] == tokenTypes['EndTag']:
                    token['data'] = '</%s>' % token['name']
                elif token['data']:
                    attrs = ''.join([' %s="%s"' % (k, escape(v)) for k, v in
                                    token['data']])
                    token['data'] = '<%s%s>' % (token['name'], attrs)
                else:
                    token['data'] = '<%s>' % token['name']
                if token['selfClosing']:
                    token['data'] = token['data'][:-1] + '/>'
                token['type'] = tokenTypes['Characters']
                del token["name"]
                return token
        elif token['type'] == tokenTypes['Comment']:
            if not self.strip_html_comments:
                return token
        else:
            return token
Sanitize a token either by HTML-encoding or dropping.

        Unlike HTMLSanitizerMixin.sanitize_token, allowed_attributes can be
        a dict of {'tag': ['attribute', 'pairs'], 'tag': callable}.

        Here callable is a function with two arguments of attribute name
        and value. It should return true of false.

        Also gives the option to strip tags instead of encoding.

        
Sanitize a token either by HTML-encoding or dropping.

Here callable is a function with two arguments of attribute name
and value. It should return true of false.

Also gives the option to strip tags instead of encoding.
Sanitize a token either by HTML - encoding or dropping . Here callable is a function with two arguments of attribute name and value . It should return true of false . Also gives the option to strip tags instead of encoding .
def sanitize_token(self, token):
        if (getattr(self, 'wildcard_attributes', None) is None and
            isinstance(self.allowed_attributes, dict)):
            self.wildcard_attributes = self.allowed_attributes.get('*', [])
        if token['type'] in (tokenTypes['StartTag'], tokenTypes['EndTag'],
                             tokenTypes['EmptyTag']):
            if token['name'] in self.allowed_elements:
                if 'data' in token:
                    if isinstance(self.allowed_attributes, dict):
                        allowed_attributes = self.allowed_attributes.get(
                            token['name'], [])
                        if not callable(allowed_attributes):
                            allowed_attributes += self.wildcard_attributes
                    else:
                        allowed_attributes = self.allowed_attributes
                    attrs = dict([(name, val) for name, val in
                                  token['data'][::-1]
                                  if (allowed_attributes(name, val)
                                      if callable(allowed_attributes)
                                      else name in allowed_attributes)])
                    for attr in self.attr_val_is_uri:
                        if not attr in attrs:
                            continue
                        val_unescaped = re.sub("[`\000-\040\177-\240\s]+", '',
                                               unescape(attrs[attr])).lower()
                        val_unescaped = val_unescaped.replace(u"\ufffd", "")
                        if (re.match(r'^[a-z0-9][-+.a-z0-9]*:', val_unescaped)
                            and (val_unescaped.split(':')[0] not in
                                 self.allowed_protocols)):
                            del attrs[attr]
                    for attr in self.svg_attr_val_allows_ref:
                        if attr in attrs:
                            attrs[attr] = re.sub(r'url\s*\(\s*[^#\s][^)]+?\)',
                                                 ' ',
                                                 unescape(attrs[attr]))
                    if (token['name'] in self.svg_allow_local_href and
                        'xlink:href' in attrs and
                        re.search(r'^\s*[^#\s].*', attrs['xlink:href'])):
                        del attrs['xlink:href']
                    if 'style' in attrs:
                        attrs['style'] = self.sanitize_css(attrs['style'])
                    token['data'] = [(name, val) for name, val in
                                     attrs.items()]
                return token
            elif self.strip_disallowed_elements:
                pass
            else:
                if token['type'] == tokenTypes['EndTag']:
                    token['data'] = '</%s>' % token['name']
                elif token['data']:
                    attrs = ''.join([' %s="%s"' % (k, escape(v)) for k, v in
                                    token['data']])
                    token['data'] = '<%s%s>' % (token['name'], attrs)
                else:
                    token['data'] = '<%s>' % token['name']
                if token['selfClosing']:
                    token['data'] = token['data'][:-1] + '/>'
                token['type'] = tokenTypes['Characters']
                del token["name"]
                return token
        elif token['type'] == tokenTypes['Comment']:
            if not self.strip_html_comments:
                return token
        else:
            return token
def sanitize_token ( self , token ) : if ( getattr ( self , 'wildcard_attributes' , None ) is None and isinstance ( self . allowed_attributes , dict ) ) : self . wildcard_attributes = self . allowed_attributes . get ( '*' , [ ] ) if token [ 'type' ] in ( tokenTypes [ 'StartTag' ] , tokenTypes [ 'EndTag' ] , tokenTypes [ 'EmptyTag' ] ) : if token [ 'name' ] in self . allowed_elements : if 'data' in token : if isinstance ( self . allowed_attributes , dict ) : allowed_attributes = self . allowed_attributes . get ( token [ 'name' ] , [ ] ) if not callable ( allowed_attributes ) : allowed_attributes += self . wildcard_attributes else : allowed_attributes = self . allowed_attributes attrs = dict ( [ ( name , val ) for name , val in token [ 'data' ] [ : : - 1 ] if ( allowed_attributes ( name , val ) if callable ( allowed_attributes ) else name in allowed_attributes ) ] ) for attr in self . attr_val_is_uri : if not attr in attrs : continue val_unescaped = re . sub ( "[`\000-\040\177-\240\s]+" , '' , unescape ( attrs [ attr ] ) ) . lower ( ) val_unescaped = val_unescaped . replace ( u"\ufffd" , "" ) if ( re . match ( r'^[a-z0-9][-+.a-z0-9]*:' , val_unescaped ) and ( val_unescaped . split ( ':' ) [ 0 ] not in self . allowed_protocols ) ) : del attrs [ attr ] for attr in self . svg_attr_val_allows_ref : if attr in attrs : attrs [ attr ] = re . sub ( r'url\s*\(\s*[^#\s][^)]+?\)' , ' ' , unescape ( attrs [ attr ] ) ) if ( token [ 'name' ] in self . svg_allow_local_href and 'xlink:href' in attrs and re . search ( r'^\s*[^#\s].*' , attrs [ 'xlink:href' ] ) ) : del attrs [ 'xlink:href' ] if 'style' in attrs : attrs [ 'style' ] = self . sanitize_css ( attrs [ 'style' ] ) token [ 'data' ] = [ ( name , val ) for name , val in attrs . items ( ) ] return token elif self . strip_disallowed_elements : pass else : if token [ 'type' ] == tokenTypes [ 'EndTag' ] : token [ 'data' ] = '</%s>' % token [ 'name' ] elif token [ 'data' ] : attrs = '' . join ( [ ' %s="%s"' % ( k , escape ( v ) ) for k , v in token [ 'data' ] ] ) token [ 'data' ] = '<%s%s>' % ( token [ 'name' ] , attrs ) else : token [ 'data' ] = '<%s>' % token [ 'name' ] if token [ 'selfClosing' ] : token [ 'data' ] = token [ 'data' ] [ : - 1 ] + '/>' token [ 'type' ] = tokenTypes [ 'Characters' ] del token [ "name" ] return token elif token [ 'type' ] == tokenTypes [ 'Comment' ] : if not self . strip_html_comments : return token else : return token
Sanitize a token either by HTML-encoding or dropping.
Sanitize a token either by HTML - encoding or dropping .
"""Sanitize a token either by HTML-encoding or dropping.

        Unlike HTMLSanitizerMixin.sanitize_token, allowed_attributes can be
        a dict of {'tag': ['attribute', 'pairs'], 'tag': callable}.

        Here callable is a function with two arguments of attribute name
        and value. It should return true of false.

        Also gives the option to strip tags instead of encoding.

        """ # Remove replacement characters from unescaped # characters.
self
token