chore(deps): replace bleach with nh3 for HTML sanitization

bleach is deprecated and archived. nh3 is its Rust-backed successor,
actively maintained and significantly faster.

Author: valentijnscholten

dojo/templatetags/display_tags.py

@@ -8,10 +8,9 @@
 from itertools import chain
 from pathlib import Path
 
-import bleach
 import dateutil.relativedelta
 import markdown
-from bleach.css_sanitizer import CSSSanitizer
+import nh3
 from django import template
 from django.conf import settings
 from django.contrib.auth.models import User
@@ -51,17 +50,21 @@
 }
 
 markdown_attrs = {
-    "*": ["id"],
-    "img": ["src", "alt", "title", "width", "height", "style"],
-    "a": ["href", "alt", "target", "title"],
-    "span": ["class"],  # used for code highlighting
-    "pre": ["class"],  # used for code highlighting
-    "div": ["class"],  # used for code highlighting
+    "*": {"id"},
+    "img": {"src", "alt", "title", "width", "height"},
+    "a": {"href", "alt", "target", "title"},
+    "span": {"class"},  # used for code highlighting
+    "pre": {"class"},  # used for code highlighting
+    "div": {"class"},  # used for code highlighting
 }
 
-markdown_styles = [
-    "background-color",
-]
+# nh3 base allowlist (equivalent to bleach.ALLOWED_TAGS / bleach.ALLOWED_ATTRIBUTES)
+_NH3_ALLOWED_TAGS = {"a", "abbr", "acronym", "b", "blockquote", "code", "em", "i", "li", "ol", "strong", "ul"}
+_NH3_ALLOWED_ATTRIBUTES = {
+    "a": {"href", "title", "target"},
+    "abbr": {"title"},
+    "acronym": {"title"},
+}
 
 finding_related_action_classes_dict = {
     "reset_finding_duplicate_status": "fa-solid fa-eraser",
@@ -92,21 +95,13 @@ def markdown_render(value):
                                                       "markdown.extensions.fenced_code",
                                                       "markdown.extensions.toc",
                                                       "markdown.extensions.tables"])
-        return mark_safe(bleach.clean(markdown_text, tags=markdown_tags, attributes=markdown_attrs, css_sanitizer=CSSSanitizer(allowed_css_properties=markdown_styles)))
+        return mark_safe(nh3.clean(markdown_text, tags=markdown_tags, attributes=markdown_attrs))
     return None
 
 
 @register.filter
 def bleach_with_a_tags(message):
-    # Create a copy of ALLOWED_ATTRIBUTES to avoid mutating the global
-    allowed_attributes = {
-        **bleach.ALLOWED_ATTRIBUTES,
-        "a": [*bleach.ALLOWED_ATTRIBUTES.get("a", []), "style", "target"],
-    }
-    return mark_safe(bleach.clean(
-        message,
-        attributes=allowed_attributes,
-        css_sanitizer=CSSSanitizer(allowed_css_properties=["color", "font-weight"])))
+    return mark_safe(nh3.clean(message, tags=_NH3_ALLOWED_TAGS, attributes=_NH3_ALLOWED_ATTRIBUTES))
 
 
 def text_shortener(value, length):

dojo/templatetags/get_banner.py

@@ -1,9 +1,9 @@
-import bleach
-from bleach.css_sanitizer import CSSSanitizer
+import nh3
 from django import template
 from django.utils.safestring import mark_safe
 
 from dojo.models import BannerConf
+from dojo.templatetags.display_tags import _NH3_ALLOWED_ATTRIBUTES, _NH3_ALLOWED_TAGS
 
 register = template.Library()
 
@@ -15,16 +15,8 @@ def get_banner_conf(attribute):
         value = getattr(banner_config, attribute, None)
         if value:
             if attribute == "banner_message":
-                # only admin can edit login banner, so we allow html, but still bleach it
-                # Create a copy of ALLOWED_ATTRIBUTES to avoid mutating the global
-                allowed_attributes = {
-                    **bleach.ALLOWED_ATTRIBUTES,
-                    "a": [*bleach.ALLOWED_ATTRIBUTES.get("a", []), "style", "target"],
-                }
-                return mark_safe(bleach.clean(
-                    value,
-                    attributes=allowed_attributes,
-                    css_sanitizer=CSSSanitizer(allowed_css_properties=["color", "font-weight"])))
+                # only admin can edit login banner, so we allow html, but still sanitize it
+                return mark_safe(nh3.clean(value, tags=_NH3_ALLOWED_TAGS, attributes=_NH3_ALLOWED_ATTRIBUTES))
             return value
     except Exception:
         return False

dojo/utils.py

@@ -17,9 +17,9 @@
 from math import pi, sqrt
 from pathlib import Path
 
-import bleach
 import crum
 import cvss
+import nh3
 import redis as redis_lib
 import vobject
 from amqp.exceptions import ChannelError
@@ -1539,7 +1539,7 @@ def create_bleached_link(url, title):
     link += '">'
     link += title
     link += "</a>"
-    return bleach.clean(link, tags={"a"}, attributes={"a": ["href", "target", "title"]})
+    return nh3.clean(link, tags={"a"}, attributes={"a": {"href", "target", "title"}})
 
 
 def get_object_or_none(klass, *args, **kwargs):

requirements.txt

@@ -1,6 +1,5 @@
 # requirements.txt for DefectDojo using Python 3.x
-bleach==6.3.0
-bleach[css]
+nh3
 celery[sqs]==5.6.3
 # pycurl and boto3 are included via celery[sqs] for Celery Broker AWS (SQS) support
 defusedxml==0.7.1