Sanitize MarkupField content with nh3 (#3067)

Co-authored-by: tonghuaroot (童话) <23011166+tonghuaroot@users.noreply.github.com>

Author: sethmlarson

apps/events/tests/test_importer.py

@@ -59,7 +59,8 @@ def test_modified_event(self):
         e = Event.objects.get(uid="8ceqself979pphq4eu7l5e2db8@google.com")
         self.assertEqual(e.calendar.url, EVENTS_CALENDAR_URL)
         self.assertEqual(
-            e.description.rendered, '<a href="https://www.barcamptools.eu/pycamp201604">PythonCamp Cologne 2016</a>'
+            e.description.rendered,
+            '<a href="https://www.barcamptools.eu/pycamp201604" rel="noopener noreferrer">PythonCamp Cologne 2016</a>',
         )
         self.assertTrue(e.next_or_previous_time.all_day)
         self.assertEqual(make_aware(datetime(year=2016, month=4, day=2)), e.next_or_previous_time.dt_start)

apps/nominations/tests/test_models.py

@@ -1,5 +1,6 @@
 import datetime
 
+from django.conf import settings
 from django.test import TestCase
 
 from apps.nominations.models import DEFAULT_ACCENT_COLOR, Election, ElectionKind
@@ -50,3 +51,22 @@ def test_accent_color_falls_back_after_kind_deleted(self):
 
         self.assertIsNone(self.election.kind)
         self.assertEqual(self.election.accent_color, DEFAULT_ACCENT_COLOR)
+
+
+class MarkupSanitizationTests(TestCase):
+    def _render(self, markup_type, text):
+        renderers = {entry[0]: entry[1] for entry in settings.MARKUP_FIELD_TYPES}
+        return renderers[markup_type](text)
+
+    def test_markdown_strips_javascript_uri(self):
+        rendered = self._render("markdown", "[x](javascript:alert(document.domain))")
+        self.assertNotIn("javascript:", rendered)
+
+    def test_markdown_preserves_safe_links_and_formatting(self):
+        rendered = self._render("markdown", "[ok](https://www.python.org) **bold**")
+        self.assertIn('href="https://www.python.org"', rendered)
+        self.assertIn("<strong>bold</strong>", rendered)
+
+    def test_restructuredtext_strips_javascript_uri(self):
+        rendered = self._render("restructuredtext", "`x <javascript:alert(1)>`_")
+        self.assertNotIn("javascript:", rendered)

pydotorg/markup.py

@@ -0,0 +1,94 @@
+"""Sanitized markup renderers for MarkupField content.
+
+django-markupfield marks the rendered markdown/RST output safe and templates
+print it with ``|safe``. The bundled renderers preserve link schemes such as
+``javascript:`` in hrefs, and the site sends no Content-Security-Policy, so an
+unsafe scheme in a markup link would execute in the browser of anyone viewing
+the page.
+
+Each default renderer is wrapped so its HTML passes through ``nh3.clean`` with
+an http/https/mailto URL-scheme allowlist (plus a tag/attribute allowlist)
+before it is marked safe. Wiring this through ``MARKUP_FIELD_TYPES`` covers
+every MarkupField (nominations, jobs, success stories, comments) at once.
+"""
+
+import nh3
+from markupfield.markup import DEFAULT_MARKUP_TYPES
+
+ALLOWED_TAGS = {
+    "a",
+    "abbr",
+    "b",
+    "blockquote",
+    "br",
+    "caption",
+    "code",
+    "col",
+    "colgroup",
+    "dd",
+    "del",
+    "div",
+    "dl",
+    "dt",
+    "em",
+    "figcaption",
+    "figure",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "hr",
+    "i",
+    "img",
+    "ins",
+    "kbd",
+    "li",
+    "ol",
+    "p",
+    "pre",
+    "s",
+    "span",
+    "strong",
+    "sub",
+    "sup",
+    "table",
+    "tbody",
+    "td",
+    "tfoot",
+    "th",
+    "thead",
+    "tr",
+    "ul",
+}
+
+ALLOWED_ATTRIBUTES = {
+    "*": {"class", "id", "title"},
+    "a": {"href"},
+    "img": {"src", "alt", "width", "height"},
+    "td": {"align", "colspan", "rowspan"},
+    "th": {"align", "colspan", "rowspan", "scope"},
+}
+
+ALLOWED_URL_SCHEMES = {"http", "https", "mailto"}
+
+
+def sanitize(html):
+    """Drop links and attributes whose scheme/name is not allowlisted."""
+    return nh3.clean(
+        html,
+        tags=ALLOWED_TAGS,
+        attributes=ALLOWED_ATTRIBUTES,
+        url_schemes=ALLOWED_URL_SCHEMES,
+    )
+
+
+def _sanitizing(render):
+    def sanitizing_render(markup):
+        return sanitize(render(markup))
+
+    return sanitizing_render
+
+
+MARKUP_FIELD_TYPES = [(name, _sanitizing(render), *rest) for name, render, *rest in DEFAULT_MARKUP_TYPES]

pydotorg/settings/base.py

@@ -6,6 +6,7 @@
 from dj_database_url import parse as dj_database_url_parser
 from django.contrib.messages import constants
 
+from pydotorg.markup import MARKUP_FIELD_TYPES  # noqa: F401 - read by django-markupfield via settings
 from pydotorg.settings.pipeline import PIPELINE  # noqa: F401 - accessed by django-pipeline via settings
 
 ### Basic config

pyproject.toml

@@ -10,6 +10,7 @@ name = "pythondotorg"
 version = "0.1.0"
 requires-python = ">=3.14"
 dependencies = [
+    "nh3==0.3.6",
     "dj-database-url==0.5.0",
     "django-pipeline==4.1.0",
     "django-sitetree==1.18.0",