refactor(i-g): BUG-018 Pilot — mail/services.py Split Schritt 1 (crypto+sanitize+pgp extrahiert)

Die 3 pure-function Bloecke aus services.py in eigene Sub-Module extrahiert: crypto.py (AES-256 Fernet mit Legacy-Salt + MAIL_ENCRYPTION_KEY-Guard), sanitize.py (nh3 HTML-Sanitizer), pgp.py (pgpy-basiert). Rueckwaertskompatibilitaet via Re-Export-Imports in services.py — alle 4 Consumer unveraendert. Beweis: mail+sig_label_routes 51/51 passed in 105.52s; ruff clean.
2026-08-26 09:29:47 +02:00
parent 3e43219b84
commit a1d5e56009
4 changed files with 200 additions and 160 deletions
@@ -0,0 +1,62 @@
+"""HTML sanitization for the Mail plugin using nh3.
+
+Extracted from services.py as part of the God-object split (BUG-018 pilot).
+Re-exported by ``app.plugins.builtins.mail.services``.
+"""
+
+from __future__ import annotations
+
+import nh3
+
+
+def sanitize_html(raw_html: str) -> str:
+    """Sanitize HTML using nh3 — removes script tags and dangerous attributes."""
+    if not raw_html:
+        return ""
+    return nh3.clean(
+        raw_html,
+        tags={
+            "a",
+            "b",
+            "br",
+            "div",
+            "em",
+            "h1",
+            "h2",
+            "h3",
+            "h4",
+            "h5",
+            "h6",
+            "hr",
+            "i",
+            "img",
+            "li",
+            "ol",
+            "p",
+            "span",
+            "strong",
+            "table",
+            "tbody",
+            "td",
+            "th",
+            "thead",
+            "tr",
+            "u",
+            "ul",
+            "blockquote",
+            "code",
+            "pre",
+            "font",
+            "center",
+        },
+        attributes={
+            "a": {"href", "title", "target"},
+            "img": {"src", "alt", "width", "height"},
+            "span": {"style"},
+            "div": {"style"},
+            "font": {"color", "size", "face"},
+            "p": {"style"},
+            "td": {"style"},
+            "th": {"style"},
+        },
+    )