feat: use bleach to enforce allowed tags

Author: julhoang

versions/templatetags/whats_new_extras.py

@@ -1,5 +1,6 @@
 import re
 
+import bleach
 from django import template
 from django.utils.html import escape
 from django.utils.safestring import mark_safe
@@ -11,6 +12,10 @@
 # same position — e.g. `a**b**c` stays a code span, the inner ** is not bolded.
 _INLINE_RE = re.compile(r"`([^`]+)`|\*\*([^*]+?)\*\*")
 
+# The only tags inline_markdown is allowed to emit. bleach (already a project
+# dependency via wagtail-markdown) is the source of truth for this allowlist.
+_ALLOWED_TAGS = ["code", "strong"]
+
 
 def _replace_span(match):
     if match.group(1) is not None:
@@ -23,9 +28,12 @@ def inline_markdown(value):
     """Render inline-code (`...`) and bold (**...**) markdown spans as HTML.
 
     Scoped to what `WHATS_NEW_SYSTEM_PROMPT` permits in description bullets:
-    code identifiers in single backticks and double-asterisk bold. Everything
-    else in the input is HTML-escaped.
+    code identifiers in single backticks and double-asterisk bold. The input is
+    escaped first so raw markup becomes inert text, the two permitted spans are
+    converted, then `bleach.clean` enforces the allowlist on the result.
     """
     if not value:
         return ""
-    return mark_safe(_INLINE_RE.sub(_replace_span, escape(value)))
+    html = _INLINE_RE.sub(_replace_span, escape(value))
+    cleaned = bleach.clean(html, tags=_ALLOWED_TAGS, attributes={}, strip=True)
+    return mark_safe(cleaned)

versions/tests/test_templatetags.py

@@ -62,3 +62,9 @@ def test_inline_markdown_single_asterisks_left_alone():
 def test_inline_markdown_does_not_bold_inside_code_span():
     """`**` inside a code span stays literal — a code span wins over bold."""
     assert inline_markdown("`a**b**c`") == "<code>a**b**c</code>"
+
+
+def test_inline_markdown_strips_disallowed_tags_via_bleach():
+    """bleach enforces the <code>/<strong> allowlist; an unescaped angle
+    bracket inside a bold span is neutralized without dropping content."""
+    assert inline_markdown("**a<b** test") == "<strong>a&lt;b</strong> test"