I've successfully implemented django-ckeditor with Django REST Framework and React, but I'm pretty sure that the way I've done it is not secure.
I've created an art blog, where each art piece has a rich-text description. Here's a basic example of one of my models with a rich-text field:
from ckeditor.fields import RichTextField
class Artist(models.Model):
biography = RichTextField(blank=True, null=False)
...
So, if saved his biography as "He was a nice guy!", then DRF serializes that as:
<p>He was a <em><strong>nice guy!</strong></em></p>
In my React app, I render it with:
<div dangerouslySetInnerHTML={{__html: artist.biography}} />
But, as the name implies, the React documentation says that this is generally risky.
This is a personal blog, so I'm not worried about other users injecting code into posts. However, I'm sure that someday I'll want to provide a rich-text editor for my users.
Is there a way to implement CKEditor with Django rest framework that doesn't require me to use dangerouslySetInnerHTML? If not, how can I safely implement a rich-text editor, and still use it with DRF?
UPDATE
I've been doing a bit more research, and I've discovered something from Mozilla called Bleach. They describe it this way:
Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes.
They go on to say:
Bleach is intended for sanitizing text from untrusted sources. If you find yourself jumping through hoops to allow your site administrators to do lots of things, you're probably outside the use cases. Either trust those users, or don't.
So, in this case, I don't think I need it. Perhaps I'll use it in future projects though.
That still doesn't help me avoid using dangerouslySetInnerHTML, but this is the most practical solution that I can think of.