fix(bleach-to-nh3): migrate os_message.py and fix test assertions for nh3

- Replace bleach with nh3 in dojo/announcement/os_message.py (was
  causing ModuleNotFoundError in 132 rest-framework tests)
- Update sonarqube importer test assertions to match nh3 output, which
  adds rel="noopener noreferrer" to all links

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: valentijnscholten

dojo/announcement/os_message.py

@@ -1,7 +1,7 @@
 import logging
 
-import bleach
 import markdown
+import nh3
 import requests
 from django.core.cache import cache
 
@@ -75,11 +75,10 @@ def parse_os_message(text):
 
     headline_source = headline_source[:100]
     headline_rendered = markdown.markdown(headline_source)
-    headline_cleaned = bleach.clean(
+    headline_cleaned = nh3.clean(
         headline_rendered,
-        tags=INLINE_TAGS,
-        attributes=INLINE_ATTRS,
-        strip=True,
+        tags=set(INLINE_TAGS),
+        attributes={k: set(v) for k, v in INLINE_ATTRS.items()},
     )
     headline_html = _strip_outer_p(headline_cleaned)
 
@@ -98,11 +97,10 @@ def parse_os_message(text):
                 expanded_source,
                 extensions=["extra", "fenced_code", "nl2br"],
             )
-            expanded_html = bleach.clean(
+            expanded_html = nh3.clean(
                 expanded_rendered,
-                tags=BLOCK_TAGS,
-                attributes=BLOCK_ATTRS,
-                strip=True,
+                tags=set(BLOCK_TAGS),
+                attributes={k: set(v) for k, v in BLOCK_ATTRS.items()},
             )
 
     return {"message": headline_html, "expanded_html": expanded_html}

unittests/tools/test_api_sonarqube_importer.py

@@ -351,8 +351,8 @@ def test_get_rule_details_sanitizes_markdown_html(self):
         )
 
         self.assertIn("<h1>Heading</h1>", rule_details)
-        self.assertIn('<a href="https://example.com">safe</a>', rule_details)
-        self.assertIn("<a>unsafe</a>", rule_details)
+        self.assertIn('<a href="https://example.com" rel="noopener noreferrer">safe</a>', rule_details)
+        self.assertIn('<a rel="noopener noreferrer">unsafe</a>', rule_details)
         self.assertNotIn("<script", rule_details)
         self.assertNotIn("alert('boom')", rule_details)
         self.assertNotIn("javascript:", rule_details)
@@ -370,8 +370,8 @@ def test_get_rule_details_sanitizes_html_desc(self):
         )
 
         self.assertIn("<h2>References</h2>", rule_details)
-        self.assertIn('<a href="https://owasp.org">OWASP</a>', rule_details)
-        self.assertIn("<a>unsafe</a>", rule_details)
+        self.assertIn('<a href="https://owasp.org" rel="noopener noreferrer">OWASP</a>', rule_details)
+        self.assertIn('<a rel="noopener noreferrer">unsafe</a>', rule_details)
         self.assertNotIn("<style", rule_details)
         self.assertNotIn("display: none", rule_details)
         self.assertNotIn("javascript:", rule_details)