chore: replace bleach with nh3

xmodule/lti_block.py

@@ -63,7 +63,7 @@ from xml.sax.saxutils import escape
 from unittest import mock
 from urllib import parse
 
-import bleach
+import nh3
 import oauthlib.oauth1
 from django.conf import settings
 from lxml import etree
@@ -458,17 +458,43 @@ class LTIBlock(
         """
         Returns a context.
         """
-        # use bleach defaults. see https://github.com/jsocol/bleach/blob/master/bleach/__init__.py
+        # nh3 defaults for
         # ALLOWED_TAGS are
-        # ['a', 'abbr', 'acronym', 'b', 'blockquote', 'code', 'em', 'i', 'li', 'ol',  'strong', 'ul']
+        # {
+        #   'a', 'abbr', 'acronym', 'area', 'article', 'aside', 'b', 'bdi', 'bdo',
+        #   'blockquote', 'br', 'caption', 'center', 'cite', 'code', 'col', 'colgroup',
+        #   'data', 'dd', 'del', 'details', 'dfn', 'div', 'dl', 'dt', 'em', 'figcaption',
+        #   'figure', 'footer', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'hgroup',
+        #   'hr', 'i', 'img', 'ins', 'kbd', 'li', 'map', 'mark', 'nav', 'ol', 'p', 'pre',
+        #   'q', 'rp', 'rt', 'rtc', 'ruby', 's', 'samp', 'small', 'span', 'strike',
+        #   'strong', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'th', 'thead',
+        #   'time', 'tr', 'tt', 'u', 'ul', 'var', 'wbr'
+        # }
         #
         # ALLOWED_ATTRIBUTES are
-        #     'a': ['href', 'title'],
-        #     'abbr': ['title'],
-        #     'acronym': ['title'],
+        # {
+        #   'a': {'href', 'hreflang'},
+        #   'bdo': {'dir'},
+        #   'blockquote': {'cite'},
+        #   'col': {'charoff', 'char', 'align', 'span'},
+        #   'colgroup': {'align', 'char', 'charoff', 'span'},
+        #   'del': {'datetime', 'cite'},
+        #   'hr': {'width', 'align', 'size'},
+        #   'img': {'height', 'src', 'width', 'alt', 'align'},
+        #   'ins': {'datetime', 'cite'},
+        #   'ol': {'start'},
+        #   'q': {'cite'},
+        #   'table': {'align', 'char', 'charoff', 'summary'},
+        #   'tbody': {'align', 'char', 'charoff'},
+        #   'td': {'rowspan', 'headers', 'charoff', 'colspan', 'char', 'align'},
+        #   'tfoot': {'align', 'char', 'charoff'},
+        #   'th': {'rowspan', 'headers', 'charoff', 'colspan', 'scope', 'char', 'align'},
+        #   'thead': {'charoff', 'char', 'align'},
+        #   'tr': {'align', 'char', 'charoff'}
+        # }
         #
         # This lets all plaintext through.
-        sanitized_comment = bleach.clean(self.score_comment)
+        sanitized_comment = nh3.clean(self.score_comment)
 
         return {
             'input_fields': self.get_input_fields(),