starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

[PR #9522] [MERGED] Fixes #9108 & #8944 - Sanitize HTML after rendering markdown #13478

New Issue
Closed
opened 2025-12-29 23:19:05 +01:00 by adam · 0 comments
adam commented 2025-12-29 23:19:05 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/netbox-community/netbox/pull/9522
Author: @kkthxbye-code
Created: 6/11/2022
Status: ✅ Merged
Merged: 6/20/2022
Merged by: @jeremystretch

Base: develop ← Head: fix-9108

📝 Commits (1)

  • 7c79c90 Sanitize HTML after rendering markdown

📊 Changes

4 files changed (+42 additions, -13 deletions)

View changed files

📝 base_requirements.txt (+4 -0)
📝 netbox/utilities/templatetags/builtins/filters.py (+6 -13)
📝 netbox/utilities/utils.py (+31 -0)
📝 requirements.txt (+1 -0)

📄 Description

Fixes: #9108 and #8944

This PR removes the stripping of all HTML tags and the workarounds for sanitizing markdown links. Instead the HTML output of python-markdown is sanitized using bleach. The result is a more correct handling of markdown (HTML is explicitly allowed in the markdown spec) while still preventing user defined HTML that might result in XSS, by sanitizing with a whitelist approach.

From a little unscientific testing of a journal page with extreme markdown usage, the performance penalty is very slight (2-5% of total page load time).

I targeted this at the feature branch as a new dependency is added, not sure if that is correct. If it's not I'll change the target branch.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbox-community/netbox/pull/9522 **Author:** [@kkthxbye-code](https://github.com/kkthxbye-code) **Created:** 6/11/2022 **Status:** ✅ Merged **Merged:** 6/20/2022 **Merged by:** [@jeremystretch](https://github.com/jeremystretch) **Base:** `develop` ← **Head:** `fix-9108` --- ### 📝 Commits (1) - [`7c79c90`](https://github.com/netbox-community/netbox/commit/7c79c90cd2403d15f30a74a97892c5237ea213d4) Sanitize HTML after rendering markdown ### 📊 Changes **4 files changed** (+42 additions, -13 deletions) <details> <summary>View changed files</summary> 📝 `base_requirements.txt` (+4 -0) 📝 `netbox/utilities/templatetags/builtins/filters.py` (+6 -13) 📝 `netbox/utilities/utils.py` (+31 -0) 📝 `requirements.txt` (+1 -0) </details> ### 📄 Description ### Fixes: #9108 and #8944 This PR removes the stripping of all HTML tags and the workarounds for sanitizing markdown links. Instead the HTML output of python-markdown is sanitized using [bleach](https://github.com/mozilla/bleach). The result is a more correct handling of markdown (HTML is explicitly allowed in the markdown spec) while still preventing user defined HTML that might result in XSS, by sanitizing with a whitelist approach. From a little unscientific testing of a journal page with extreme markdown usage, the performance penalty is very slight (2-5% of total page load time). I targeted this at the feature branch as a new dependency is added, not sure if that is correct. If it's not I'll change the target branch. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 23:19:05 +01:00
adam closed this issue 2025-12-29 23:19:06 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#13478
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?