Upgrade bleach to 2.1.4

Update ORA2 repo version

Fix Python tests

Upgrade Recommender XBlock version

Remove unnecessary requirements and update bleacher usage

Keep html5lib unpinned

Upgrading requirements

Ignore python-interpolate-html for bleached html

common/lib/capa/capa/util.py

@@ -171,10 +171,6 @@ def sanitize_html(html_code):
     Used to sanitize XQueue responses from Matlab.
     """
     attributes = bleach.ALLOWED_ATTRIBUTES.copy()
-    # Yuck! but bleach does not offer the option of passing in allowed_protocols,
-    # and matlab uses data urls for images
-    if u'data' not in bleach.BleachSanitizer.allowed_protocols:
-        bleach.BleachSanitizer.allowed_protocols.append(u'data')
     attributes.update({
         '*': ['class', 'style', 'id'],
         'audio': ['controls', 'autobuffer', 'autoplay', 'src'],
@@ -182,6 +178,7 @@ def sanitize_html(html_code):
     })
     output = bleach.clean(
         html_code,
+        protocols=bleach.ALLOWED_PROTOCOLS + ['data'],
         tags=bleach.ALLOWED_TAGS + ['div', 'p', 'audio', 'pre', 'img', 'span'],
         styles=['white-space'],
         attributes=attributes
@@ -197,6 +194,7 @@ def get_inner_html_from_xpath(xpath_node):
     # returns string from xpath node
     html = etree.tostring(xpath_node).strip()
     # strips outer tag from html string
+    # xss-lint: disable=python-interpolate-html
     inner_html = re.sub('(?ms)<%s[^>]*>(.*)</%s>' % (xpath_node.tag, xpath_node.tag), '\\1', html)
     return inner_html.strip()