remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-11 11:04:07 +02:00
Code Issues Projects Releases Packages Wiki Activity

Validate URL before rendering column links

Browse source
This commit is contained in:
Simon Willison 2026-09-08 20:56:33 -07:00
commit 59618371e9
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
datasette/default_column_types.py
View file

@ -5,6 +5,7 @@ import markupsafe
from datasette import hookimpl
from datasette.column_types import ColumnType, SQLiteType
from datasette.utils import is_url
class UrlColumnType(ColumnType):
@ -15,7 +16,10 @@ class UrlColumnType(ColumnType):
async def render_cell(self, value, column, table, database, datasette, request):
if not value or not isinstance(value, str):
return None
escaped = markupsafe.escape(value.strip())
stripped = value.strip()
if not is_url(stripped):
return None
escaped = markupsafe.escape(stripped)
return markupsafe.Markup(f'<a href="{escaped}">{escaped}</a>')
async def validate(self, value, datasette):