replace bleach with nh3 for HTML sanitization by valentijnscholten · Pull Request #14442

replace bleach with nh3 for HTML sanitization by valentijnscholten · Pull Request #14442 · DefectDojo/django-DefectDojo

bleach is deprecated and archived. nh3 is its Rust-backed successor,
actively maintained and significantly faster.

valentijnscholten changed the title ~~chore(deps): replace bleach with nh3 for HTML sanitization~~ replace bleach with nh3 for HTML sanitization

Mar 4, 2026

…link

- Use escape() when building HTML in create_bleached_link so attribute
  values are properly encoded before nh3 parses them (prevents raw tags
  in href/title when user-supplied content contains HTML)
- Add rel="noopener noreferrer" to all expected link strings in tests
  (nh3 automatically injects this on target="_blank" links)
- Replace exact-output XSS assertion with semantic safety checks

nh3/ammonia does not re-escape < in attribute values when re-serializing,
so passing escape()'d HTML through nh3.clean() still produced raw angle
brackets in href/title. The function constructs trusted HTML itself, so
nh3 is redundant here — escape() is sufficient and correct.

Also adds rel="noopener noreferrer" explicitly and updates tests to
match the new output including the exact XSS-escaped form.