fix: use escape() directly in create_bleached_link, drop nh3

nh3/ammonia does not re-escape < in attribute values when re-serializing,
so passing escape()'d HTML through nh3.clean() still produced raw angle
brackets in href/title. The function constructs trusted HTML itself, so
nh3 is redundant here — escape() is sufficient and correct.

Also adds rel="noopener noreferrer" explicitly and updates tests to
match the new output including the exact XSS-escaped form.

Author: valentijnscholten

dojo/utils.py

@@ -19,7 +19,6 @@
 
 import crum
 import cvss
-import nh3
 import redis as redis_lib
 import vobject
 from amqp.exceptions import ChannelError
@@ -1533,9 +1532,8 @@ def get_current_request():
 
 
 def create_bleached_link(url, title):
-    # nh3 requires an explicit escape
-    link = f'<a href="{escape(url)}" target="_blank" title="{escape(title)}">{escape(title)}</a>'
-    return nh3.clean(link, tags={"a"}, attributes={"a": {"href", "target", "title"}})
+    # escape() encodes text into HTML — the right tool for embedding URLs into attributes, not a sanitizer like nh3
+    return f'<a href="{escape(url)}" target="_blank" title="{escape(title)}" rel="noopener noreferrer">{escape(title)}</a>'
 
 
 def get_object_or_none(klass, *args, **kwargs):

unittests/test_finding_model.py

@@ -334,11 +334,13 @@ def test_get_file_path_with_xss_attack(self):
         finding.test = test
         finding.file_path = "<SCRIPT SRC=http://xss.rocks/xss.js></SCRIPT>"
         engagement.source_code_management_uri = "<IMG SRC=javascript:alert('XSS')>"
-        result = finding.get_file_path_with_link()
-        # XSS payloads must be escaped — no raw tags should appear in the output
-        self.assertNotIn("<SCRIPT", result)
-        self.assertNotIn("<IMG", result)
-        self.assertIn('rel="noopener noreferrer"', result)
+        self.assertEqual(
+            '<a href="&lt;IMG SRC=javascript:alert(&#x27;XSS&#x27;)&gt;/&lt;SCRIPT SRC=http://xss.rocks/xss.js&gt;&lt;/SCRIPT&gt;"'
+            ' target="_blank"'
+            ' title="&lt;SCRIPT SRC=http://xss.rocks/xss.js&gt;&lt;/SCRIPT&gt;"'
+            ' rel="noopener noreferrer"'
+            '>&lt;SCRIPT SRC=http://xss.rocks/xss.js&gt;&lt;/SCRIPT&gt;</a>',
+            finding.get_file_path_with_link())
 
     def test_get_references_with_links_no_references(self):
         finding = Finding()