Skip to content

2.57.md

Latest commit

 

History

History
14 lines (11 loc) · 1.17 KB

2.57.md

File metadata and controls

14 lines (11 loc) · 1.17 KB
Raw
title Upgrading to DefectDojo Version 2.57.x
toc_hide true
weight -20260302
description HTML sanitization library replaced (bleach → nh3).

Check the Release Notes for the contents of the release.

HTML sanitization: bleach replaced by nh3

The bleach library has been replaced by nh3 for HTML sanitization. This is a drop-in replacement in most cases, but there are two minor behavioral changes to be aware of:

  • style attributes are no longer allowed. bleach supported CSS property-level filtering (e.g. allowing only color or font-weight). nh3 has no equivalent, so style attributes are stripped entirely to avoid allowing arbitrary CSS injection. Content that previously relied on inline styles (e.g. colored text in the login banner, background-color on markdown images) will lose that styling.
  • Disallowed tags are stripped rather than escaped. Previously, a tag like <script> would be rendered as the literal text &lt;script&gt;. Now the tag is removed entirely and only its text content is kept. This is the correct behavior for a sanitizer.