bleach-allowlist

What it is and what it does

bleach-allowlist is a data package that bundles pre-curated allowlists of safe HTML tags, attributes, and CSS styles for use with the bleach HTML sanitization library. It eliminates the need to manually define which HTML elements and styles are permitted when filtering user-provided markup. The package includes task-specific presets: markdown_tags and markdown_attrs for rendering markdown-style HTML, print_tags and print_attrs for print/PDF output, and all_styles and standard_styles for CSS property whitelisting.

The package is designed to be used as a reference or directly passed to bleach.clean() to enforce consistent, vetted sanitization rules across applications. It has no runtime dependencies and installs with low friction, but it is no longer actively maintained—the last commit was in June 2022 and no releases have occurred since August 2020. Users should verify that the allowlists remain suitable for their current HTML and CSS requirements.

Use it for:

• Sanitizing user-submitted HTML in comment systems or forums using bleach with pre-vetted markdown-safe tag allowlists.
• Filtering HTML for PDF or print rendering by applying print_tags and print_attrs to remove web-only markup.
• Whitelisting CSS properties in user-generated content by passing all_styles or standard_styles to bleach for style attribute sanitization.
• Establishing consistent HTML sanitization policies across multiple applications by reusing the same curated allowlists.
• Rendering markdown-converted HTML safely by applying the markdown_tags and markdown_attrs presets to bleach.clean().

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides curated allowlists of HTML tags, attributes, and CSS styles for use with the bleach HTML sanitization library to safely filter user-provided markup.

Yes, if you are already using bleach and want to avoid manually curating allowlists. The permissive BSD license and zero runtime dependencies make it low-risk to add. However, the package is abandoned and has not been updated since 2020; verify that its allowlists align with your current HTML/CSS standards and consider monitoring bleach for breaking changes that this package will not address.

Install

bleach-allowlist on PyPI

pip install bleach-allowlist

uv add bleach-allowlist

poetry add bleach-allowlist

Installing bleach-allowlist

Before you install

Low install friction with no runtime dependencies. However, the package is abandoned—last commit was 2022-06-20 and no releases since 2020-08-13. Security and compatibility fixes are unlikely.

License in practice

BSD License (permissive) allows commercial and private use with minimal restrictions, making it suitable for most projects from a licensing standpoint.

Quickstart

pip install bleach-allowlist

import bleach
from bleach_allowlist import print_tags, print_attrs, all_styles

bleach.clean(raw_html, print_tags, print_attrs, all_styles)

Requires bleach to be installed separately; bleach-allowlist is only a data package of allowlists, not a complete sanitization solution.

Verify before relying

• Whether the curated allowlists remain adequate for current HTML/CSS standards given the package's abandonment since 2022.
• Compatibility with recent versions of bleach and Python versions beyond what the fact sheet specifies.

Package facts

Evidence: bleach_allowlist-1.0.3-py2.py3-none-any.whl

Tags

More WWW/HTTP packages