replace bleach with nh3 for HTML sanitization

[valentijnscholten]

Bleach has been deprecated since Feb '23. Although it still works, a security product like Defect Dojo needs to switch to the goto replacement: nh3 which is also faster.

Summary

• Replaces the deprecated (archived) bleach library with nh3, its actively maintained, Rust-backed successor
• Drops bleach[css] from requirements.txt and adds nh3
• Updates all call sites in dojo/utils.py, dojo/templatetags/display_tags.py, and dojo/templatetags/get_banner.py
• Replaces bleach.ALLOWED_TAGS / bleach.ALLOWED_ATTRIBUTES with explicit constants (_NH3_ALLOWED_TAGS, _NH3_ALLOWED_ATTRIBUTES) shared between the two template tag modules

Note on style attribute: bleach supported CSS property-level filtering via CSSSanitizer (e.g. allowing only color and font-weight). nh3 has no equivalent — it cannot filter individual CSS properties, only entire attributes. To avoid allowing arbitrary CSS injection, the style attribute is no longer permitted on any element. In practice this means inline styling (e.g. colored text in the login banner, background-color on images in markdown) will be stripped rather than sanitized. This is the safer trade-off.

Note on disallowed tag handling: bleach escaped disallowed tags (e.g. <script> → <script>), making them visible as literal text. nh3 strips them entirely, keeping only the text content. This is the correct behavior for a sanitizer.

[dryrunsecurity]

🟡 Please give this pull request extra attention during review.

This pull request introduces mark_safe around nh3.clean() output in multiple template tags (banner and markdown/bleach filters), relying on small custom allowlists for tags and attributes so Django auto-escaping is bypassed; if nh3.clean is misconfigured or the allowlists don't prevent dangerous attribute values (e.g. javascript: URIs or event handlers), attacker- or admin-controlled input could lead to XSS.

🟡 Potential Cross-Site Scripting in dojo/templatetags/display_tags.py (drs_49e90666)

Vulnerability

Potential Cross-Site Scripting

Description

The code marks nh3.clean() output as safe with mark_safe before rendering. mark_safe disables Django's auto-escaping, so the security of the rendered HTML entirely depends on nh3.clean() and the provided allowlists. The PR introduces small, custom allowlists (_NH3_ALLOWED_TAGS and _NH3_ALLOWED_ATTRIBUTES) which permit and other tags and attributes (e.g., href, target). If nh3.clean is misconfigured, incomplete, or allows dangerous attribute values (like javascript: URIs in href) or misses event handler attributes, an attacker who can control the input could inject executable content. The banner code comment notes only admins can edit the login banner, but other uses (markdown_render and bleach_with_a_tags filter) apply mark_safe to cleaned user content; unless nh3.clean enforces context-appropriate encoding (and validates attribute schemes like href), this pattern is risky and can lead to XSS.

django-DefectDojo/dojo/templatetags/display_tags.py

Lines 94 to 106 in 6a4516f

	"markdown.extensions.fenced_code",
	"markdown.extensions.toc",
	"markdown.extensions.tables"])
	return mark_safe(nh3.clean(markdown_text, tags=markdown_tags, attributes=markdown_attrs))
	return None
	@register.filter
	def bleach_with_a_tags(message):
	return mark_safe(nh3.clean(message, tags=_NH3_ALLOWED_TAGS, attributes=_NH3_ALLOWED_ATTRIBUTES))
	def text_shortener(value, length):

🟡 Potential Cross-Site Scripting in dojo/templatetags/get_banner.py (drs_c675ef32)

Vulnerability

Potential Cross-Site Scripting

Description

The code returns mark_safe(nh3.clean(value, tags=_NH3_ALLOWED_TAGS, attributes=_NH3_ALLOWED_ATTRIBUTES)) for banner_message which bypasses Django template escaping. Although nh3.clean is used, the patch defines a small explicit allowlist (_NH3_ALLOWED_TAGS and _NH3_ALLOWED_ATTRIBUTES) and then uses mark_safe on the cleaned value. If nh3.clean is not equivalent to a proven HTML sanitizer (e.g., DOMPurify/bleach) for all contexts, or its configuration allows dangerous attribute values (for example href="javascript:..." or event handlers) or the allowed attribute set or tag set is incomplete, user-controllable content could reach the rendered HTML unsafely resulting in XSS. The comment indicates the field is editable by admins only, but using mark_safe still exposes rendered pages to any admin-supplied HTML. No further context-appropriate encoding (e.g., attribute or JS context escaping) is applied.

django-DefectDojo/dojo/templatetags/get_banner.py

Lines 19 to 22 in 6a4516f

	return mark_safe(nh3.clean(value, tags=_NH3_ALLOWED_TAGS, attributes=_NH3_ALLOWED_ATTRIBUTES))
	return value
	except Exception:
	return False

---

Comment to provide feedback on these findings.

Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]

Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing

All finding details can be found in the DryRun Security Dashboard.