使用Python的bleach库时如何允许所有CSS样式？

运行以下代码后，所有style属性均被移除，请问是否有办法保留所有CSS样式属性？曾尝试使用CSSSanitizer的不同配置，但未找到允许所有样式的实现方式。

import bleach
from bleach.css_sanitizer import CSSSanitizer

ALLOWED_ATTRIBUTES = {"table": ['width', 'style'], "tr": ['style'], "td": ['width', 'style'], "h3": ['style'], "p": ['style']}
ALLOWED_TAGS = ['table', 'tr', 'td', 'p', 'h3', 'b', 'br', 'div', 'h5', 'hr', 'i', 'span', 'strong', 'u']

def sanitize_html_body(value):
    cleaned_value = bleach.clean(value, tags=ALLOWED_TAGS, attributes=ALLOWED_ATTRIBUTES, strip=True)   
    return cleaned_value

html_body = "<table style=\"margin:0;padding:0;border:0;font-family:Arial, Helvetica, sans-serif;border-collapse:collapse;border-spacing:0;width:100%;color:#000000;margin-bottom:14px\" width=\"100%\">\n            <tr style=\"margin:0;padding:0;border:0;font-family:Arial, Helvetica, sans-serif\">\n                <td style=\"margin:0;padding:0;border:0;font-family:Arial, Helvetica, sans-serif;vertical-align:top;text-align:center;width:60px;background:#ff5400\" width=\"60\">\n                    <b>\n                         \n                    </b>\n                </td>\n                <td style=\"margin:0;border:0;font-family:Arial, Helvetica, sans-serif;vertical-align:top;padding:18px;background:#f6f6f6\">\n                    <h3 style=\"margin:0;padding:0;border:0;font-family:Arial, Helvetica, sans-serif;font-size:18px;font-weight:bold;margin-bottom:6px\">\n                 test567 \n                    </h3>\n                    <p style=\"margin:0;padding:0;border:0;font-family:Arial, Helvetica, sans-serif;font-size:12px\">\n                     Tes1234 \n                    </p>\n                </td>\n            </tr>\n        </table>"

print(sanitize_html_body(html_body))

解决方案 #

问题核心是：默认情况下，即便你在ALLOWED_ATTRIBUTES中允许了style属性，Bleach仍会过滤style内的所有CSS内容。要保留样式，必须显式配置CSSSanitizer并传入bleach.clean()。

要保留所有CSS属性和值，可创建自定义CSSSanitizer实例，设置允许所有属性及对应的值：

import bleach
from bleach.css_sanitizer import CSSSanitizer

ALLOWED_ATTRIBUTES = {"table": ['width', 'style'], "tr": ['style'], "td": ['width', 'style'], "h3": ['style'], "p": ['style']}
ALLOWED_TAGS = ['table', 'tr', 'td', 'p', 'h3', 'b', 'br', 'div', 'h5', 'hr', 'i', 'span', 'strong', 'u']

# 配置允许所有CSS属性和值的CSSSanitizer
css_sanitizer = CSSSanitizer(
    allowed_properties=["*"],  # 允许所有CSS属性
    allowed_values={"*": ["*"]}  # 允许所有属性的任意值
)

def sanitize_html_body(value):
    cleaned_value = bleach.clean(
        value,
        tags=ALLOWED_TAGS,
        attributes=ALLOWED_ATTRIBUTES,
        css_sanitizer=css_sanitizer,  # 传入自定义CSSSanitizer
        strip=True
    )   
    return cleaned_value

html_body = "<table style=\"margin:0;padding:0;border:0;font-family:Arial, Helvetica, sans-serif;border-collapse:collapse;border-spacing:0;width:100%;color:#000000;margin-bottom:14px\" width=\"100%\">\n            <tr style=\"margin:0;padding:0;border:0;font-family:Arial, Helvetica, sans-serif\">\n                <td style=\"margin:0;padding:0;border:0;font-family:Arial, Helvetica, sans-serif;vertical-align:top;text-align:center;width:60px;background:#ff5400\" width=\"60\">\n                    <b>\n                         \n                    </b>\n                </td>\n                <td style=\"margin:0;border:0;font-family:Arial, Helvetica, sans-serif;vertical-align:top;padding:18px;background:#f6f6f6\">\n                    <h3 style=\"margin:0;padding:0;border:0;font-family:Arial, Helvetica, sans-serif;font-size:18px;font-weight:bold;margin-bottom:6px\">\n                 test567 \n                    </h3>\n                    <p style=\"margin:0;padding:0;border:0;font-family:Arial, Helvetica, sans-serif;font-size:12px\">\n                     Tes1234 \n                    </p>\n                </td>\n            </tr>\n        </table>"

print(sanitize_html_body(html_body))

注意事项 #

允许所有CSS属性和值会引入安全风险，比如攻击者可能注入恶意样式（如固定定位弹窗、隐藏恶意内容等）。如果处理的是不可信用户输入，建议仅允许业务必需的CSS属性，而非全部放开。

内容的提问来源于stack exchange，提问作者Amir Zror