feat: add nh3

.pre-commit-config.yaml

@@ -24,7 +24,7 @@ repos:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 23.11.0
+    rev: 23.12.0
     hooks:
       - id: black
   - repo: https://github.com/adrienverge/yamllint

pyproject.toml

@@ -45,6 +45,7 @@ dependencies = [
     "jira>=3.5.2",
     "drf-standardized-errors>=0.12.6",
     "aiohttp>=3.9.1", # Transitive dependency of slack_sdk
+    "nh3>=0.2.15",
 ]
 requires-python = ">=3.11,<4.0"
 license = {file = "LICENSE"}

src/firefighter/firefighter/filters.py

@@ -6,6 +6,7 @@
 from typing import TYPE_CHECKING, Any, Literal, TypeVar, cast
 
 import markdown as md
+import nh3
 from django import template
 from django.template.defaulttags import register as register_base
 
@@ -135,10 +136,12 @@ def readable_time_delta(delta: timedelta) -> str:
 def markdown(text: str) -> str:
     """Converts markdown-formatted text to HTML.
 
+    Sanitize the HTML to only allow a subset of tags.
+
     Args:
         text (str): The markdown-formatted text to convert.
 
     Returns:
         str: The HTML-formatted text.
     """
-    return md.markdown(text, output_format="html")
+    return nh3.clean(md.markdown(text, output_format="html"), tags=nh3.ALLOWED_TAGS)