Skip to content

replace bleach with nh3 for HTML sanitization #14442

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
valentijnscholten wants to merge 6 commits into
base: dev
Choose a base branch
from

Merge branch 'dev' into bleach-to-nh3

3d669fe
Select commit
Loading
Failed to load commit list.
Open

replace bleach with nh3 for HTML sanitization #14442

Merge branch 'dev' into bleach-to-nh3
3d669fe
Select commit
Loading
Failed to load commit list.
DryRunSecurity / Cross-Site Scripting Analyzer succeeded Mar 17, 2026 in 1m 10s

DryRun Security

Details

Cross-Site Scripting Analyzer Findings: 1 detected

⚠️ Potential Cross-Site Scripting dojo/templatetags/display_tags.py (click for details)
Type Potential Cross-Site Scripting
Description The code calls mark_safe on content cleaned by nh3.clean and then renders it. mark_safe disables Django's automatic escaping; if nh3.clean's allowlist (_NH3_ALLOWED_TAGS / _NH3_ALLOWED_ATTRIBUTES) permits attributes or tag combinations that can be abused (e.g., javascript: URIs in href, data URIs, or any on* event handlers) or if nh3.clean does not strip dangerous protocols/attributes, user-controlled input can reach the rendered HTML sink as unescaped markup and lead to XSS. The patch defines a relatively small allowed tag/attribute set, but there is no evidence in the patch that nh3.clean enforces safe URL schemes or strips dangerous attributes; the usage of nh3.clean + mark_safe is therefore risky and confirms a potential XSS path.
Filename dojo/templatetags/display_tags.py
CodeLink

django-DefectDojo/dojo/templatetags/display_tags.py

Lines 103 to 106 in 3d669fe

return mark_safe(nh3.clean(message, tags=_NH3_ALLOWED_TAGS, attributes=_NH3_ALLOWED_ATTRIBUTES))
def text_shortener(value, length):
View more details on DryRunSecurity