chore: replace bleach with nh3

xmodule/capa/inputtypes.py

@@ -47,7 +47,7 @@ import sys
 import time
 from datetime import datetime
 
-import bleach
+import nh3
 import html5lib
 import pyparsing
 import six
@@ -800,7 +800,7 @@ class CodeInput(InputTypeBase):
         if self.status == 'incomplete':
             self.status = 'queued'
             self.queue_len = self.msg  # lint-amnesty, pylint: disable=attribute-defined-outside-init
-            self.msg = bleach.clean(self.submitted_msg)
+            self.msg = nh3.clean(self.submitted_msg)
 
     def setup(self):
         """ setup this input type """

xmodule/capa/tests/test_inputtypes.py

@@ -916,7 +916,7 @@ class MatlabTest(unittest.TestCase):
         }
         elt = etree.fromstring(self.xml)
         the_input = self.input_class(test_capa_system(), elt, state)
-        expected = "<script>Test message</script>"
+        expected = ""
         assert the_input.queue_msg == expected
 
     def test_matlab_sanitize_msg(self):
@@ -925,7 +925,7 @@ class MatlabTest(unittest.TestCase):
         """
         not_allowed_tag = 'script'
         self.the_input.msg = "<{0}>Test message</{0}>".format(not_allowed_tag)
-        expected = "&lt;script&gt;Test message&lt;/script&gt;"
+        expected = ""
         assert self.the_input._get_render_context()['msg'] == expected  # pylint: disable=protected-access
 
 

xmodule/capa/tests/test_util.py

@@ -121,7 +121,7 @@ class UtilTest(unittest.TestCase):
 
     def test_sanitize_html(self):
         """
-        Test for html sanitization with bleach.
+        Test for html sanitization with nh3.
         """
         allowed_tags = ['div', 'p', 'audio', 'pre', 'span']
         for tag in allowed_tags:
@@ -130,7 +130,7 @@ class UtilTest(unittest.TestCase):
 
         not_allowed_tag = 'script'
         queue_msg = "<{0}>Test message</{0}>".format(not_allowed_tag)
-        expected = "&lt;script&gt;Test message&lt;/script&gt;"
+        expected = ""
         assert sanitize_html(queue_msg) == expected
 
     def test_get_inner_html_from_xpath(self):
@@ -142,7 +142,7 @@ class UtilTest(unittest.TestCase):
 
     def test_remove_markup(self):
         """
-        Test for markup removal with bleach.
+        Test for markup removal with nh3.
         """
         assert remove_markup('The <mark>Truth</mark> is <em>Out There</em> & you need to <strong>find</strong> it') ==\
                'The Truth is Out There &amp; you need to find it'

xmodule/capa/util.py

@@ -8,11 +8,10 @@ import re
 from cmath import isinf, isnan
 from decimal import Decimal
 
-import bleach
+import nh3
 from calc import evaluator
 from lxml import etree
 
-from bleach.css_sanitizer import CSSSanitizer
 from openedx.core.djangolib.markup import HTML
 
 #-----------------------------------------------------------------------------
@@ -182,17 +181,15 @@ def sanitize_html(html_code):
 
     Used to sanitize XQueue responses from Matlab.
     """
-    attributes = bleach.ALLOWED_ATTRIBUTES.copy()
+    attributes = nh3.ALLOWED_ATTRIBUTES.copy()
     attributes.update({
-        '*': ['class', 'style', 'id'],
-        'audio': ['controls', 'autobuffer', 'autoplay', 'src'],
-        'img': ['src', 'width', 'height', 'class']
+        '*': {'class', 'style', 'id'},
+        'audio': {'controls', 'autobuffer', 'autoplay', 'src'},
+        'img': {'src', 'width', 'height', 'class'}
     })
-    output = bleach.clean(
+    output = nh3.clean(
         html_code,
-        protocols=bleach.ALLOWED_PROTOCOLS | {'data'},
-        tags=bleach.ALLOWED_TAGS | {'div', 'p', 'audio', 'pre', 'img', 'span'},
-        css_sanitizer=CSSSanitizer(allowed_css_properties=["white-space"]),
+        tags=nh3.ALLOWED_TAGS | {'div', 'p', 'audio', 'pre', 'img', 'span'},
         attributes=attributes
     )
     return output
@@ -215,12 +212,12 @@ def remove_markup(html):
     """
     Return html with markup stripped and text HTML-escaped.
 
-    >>> bleach.clean("<b>Rock & Roll</b>", tags=set(), strip=True)
+    >>> nh3.clean("<b>Rock & Roll</b>", tags=set())
     'Rock &amp; Roll'
-    >>> bleach.clean("<b>Rock &amp; Roll</b>", tags=set(), strip=True)
+    >>> nh3.clean("<b>Rock &amp; Roll</b>", tags=set())
     'Rock &amp; Roll'
     """
-    return HTML(bleach.clean(html, tags=set(), strip=True))
+    return HTML(nh3.clean(html, tags=set()))
 
 
 def get_course_id_from_capa_block(capa_block):

xmodule/capa_block.py

@@ -14,7 +14,7 @@ import struct
 import sys
 import traceback
 
-from bleach.sanitizer import Cleaner
+import nh3
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured
 from django.utils.encoding import smart_str
@@ -619,7 +619,7 @@ class ProblemBlock(
         capa_content = re.sub(
             r"(\s| |//)+",
             " ",
-            Cleaner(tags=[], strip=True).clean(capa_content)
+            nh3.clean(capa_content, tags=set())
         )
 
         capa_body = {

xmodule/library_content_block.py

@@ -9,7 +9,7 @@ import random
 from copy import copy
 from gettext import ngettext, gettext
 
-import bleach
+import nh3
 from django.conf import settings
 from django.core.exceptions import ObjectDoesNotExist, PermissionDenied
 from django.utils.functional import classproperty
@@ -731,7 +731,7 @@ class LibraryContentBlock(
         lib_tools = self.get_tools()
         user_perms = self.runtime.service(self, 'studio_user_permissions')
         all_libraries = [
-            (key, bleach.clean(name)) for key, name in lib_tools.list_available_libraries()
+            (key, nh3.clean(name)) for key, name in lib_tools.list_available_libraries()
             if user_perms.can_read(key) or self.source_library_id == str(key)
         ]
         all_libraries.sort(key=lambda entry: entry[1])  # Sort by name

xmodule/lti_block.py

@@ -63,7 +63,7 @@ from xml.sax.saxutils import escape
 from unittest import mock
 from urllib import parse
 
-import bleach
+import nh3
 import oauthlib.oauth1
 from django.conf import settings
 from lxml import etree
@@ -458,17 +458,43 @@ class LTIBlock(
         """
         Returns a context.
         """
-        # use bleach defaults. see https://github.com/jsocol/bleach/blob/master/bleach/__init__.py
+        # nh3 defaults for
         # ALLOWED_TAGS are
-        # ['a', 'abbr', 'acronym', 'b', 'blockquote', 'code', 'em', 'i', 'li', 'ol',  'strong', 'ul']
+        # {
+        #   'a', 'abbr', 'acronym', 'area', 'article', 'aside', 'b', 'bdi', 'bdo',
+        #   'blockquote', 'br', 'caption', 'center', 'cite', 'code', 'col', 'colgroup',
+        #   'data', 'dd', 'del', 'details', 'dfn', 'div', 'dl', 'dt', 'em', 'figcaption',
+        #   'figure', 'footer', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'hgroup',
+        #   'hr', 'i', 'img', 'ins', 'kbd', 'li', 'map', 'mark', 'nav', 'ol', 'p', 'pre',
+        #   'q', 'rp', 'rt', 'rtc', 'ruby', 's', 'samp', 'small', 'span', 'strike',
+        #   'strong', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'th', 'thead',
+        #   'time', 'tr', 'tt', 'u', 'ul', 'var', 'wbr'
+        # }
         #
         # ALLOWED_ATTRIBUTES are
-        #     'a': ['href', 'title'],
-        #     'abbr': ['title'],
-        #     'acronym': ['title'],
+        # {
+        #   'a': {'href', 'hreflang'},
+        #   'bdo': {'dir'},
+        #   'blockquote': {'cite'},
+        #   'col': {'charoff', 'char', 'align', 'span'},
+        #   'colgroup': {'align', 'char', 'charoff', 'span'},
+        #   'del': {'datetime', 'cite'},
+        #   'hr': {'width', 'align', 'size'},
+        #   'img': {'height', 'src', 'width', 'alt', 'align'},
+        #   'ins': {'datetime', 'cite'},
+        #   'ol': {'start'},
+        #   'q': {'cite'},
+        #   'table': {'align', 'char', 'charoff', 'summary'},
+        #   'tbody': {'align', 'char', 'charoff'},
+        #   'td': {'rowspan', 'headers', 'charoff', 'colspan', 'char', 'align'},
+        #   'tfoot': {'align', 'char', 'charoff'},
+        #   'th': {'rowspan', 'headers', 'charoff', 'colspan', 'scope', 'char', 'align'},
+        #   'thead': {'charoff', 'char', 'align'},
+        #   'tr': {'align', 'char', 'charoff'}
+        # }
         #
         # This lets all plaintext through.
-        sanitized_comment = bleach.clean(self.score_comment)
+        sanitized_comment = nh3.clean(self.score_comment)
 
         return {
             'input_fields': self.get_input_fields(),

xmodule/tests/test_lti20_unit.py

@@ -45,7 +45,7 @@ class LTI20RESTResultServiceTest(unittest.TestCase):
 
         test_cases = (  # (before sanitize, after sanitize)
             ("plaintext", "plaintext"),
-            ("a <script>alert(3)</script>", "a &lt;script&gt;alert(3)&lt;/script&gt;"),  # encodes scripts
+            ("a <script>alert(3)</script>", "a "),  # drops scripts
             ("<b>bold 包</b>", "<b>bold 包</b>"),  # unicode, and <b> tags pass through
         )
         for case in test_cases: