MIT-LCP / MIT-LCP/physionet-build
Upgrade to latest bleach and/or something else
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 90
- Forks
- 33
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 31
Description
We're using what is now a rather outdated version of Bleach, and the future of Bleach itself doesn't look great.
I don't know of any existing security issues that would affect us. But in the short term we should upgrade to Bleach 6.x, and in the long term look for an alternative that has solid upstream support.
The great thing about Bleach 3.x is that its configuration format is almost identical to ckeditor's, particularly in regard to CSS. Bleach 5.x changed this, so sanitizing CSS is more complicated and it's not trivial to upgrade.
The chief alternative to bleach that seems to be recommended is ammonia, and that apparently doesn't have any support for sanitizing CSS (?!)
Our needs for handling CSS are pretty minimal, but still this is annoying.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by locating the Bleach dependency and its CSS sanitization configuration, then compare the upgrade path to Bleach 6.x with alternatives such as Ammonia; done means the dependency is supported and existing minimal CSS sanitization behavior is preserved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- css, python
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100