Agent Zero
a1d5e56009
Check Cross-Plugin Imports / check (push) Has been cancelled
Die 3 pure-function Bloecke aus services.py in eigene Sub-Module extrahiert: crypto.py (AES-256 Fernet mit Legacy-Salt + MAIL_ENCRYPTION_KEY-Guard), sanitize.py (nh3 HTML-Sanitizer), pgp.py (pgpy-basiert). Rueckwaertskompatibilitaet via Re-Export-Imports in services.py — alle 4 Consumer unveraendert. Beweis: mail+sig_label_routes 51/51 passed in 105.52s; ruff clean.
63 lines
1.4 KiB
Python
63 lines
1.4 KiB
Python
"""HTML sanitization for the Mail plugin using nh3.
|
|
|
|
Extracted from services.py as part of the God-object split (BUG-018 pilot).
|
|
Re-exported by ``app.plugins.builtins.mail.services``.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import nh3
|
|
|
|
|
|
def sanitize_html(raw_html: str) -> str:
|
|
"""Sanitize HTML using nh3 — removes script tags and dangerous attributes."""
|
|
if not raw_html:
|
|
return ""
|
|
return nh3.clean(
|
|
raw_html,
|
|
tags={
|
|
"a",
|
|
"b",
|
|
"br",
|
|
"div",
|
|
"em",
|
|
"h1",
|
|
"h2",
|
|
"h3",
|
|
"h4",
|
|
"h5",
|
|
"h6",
|
|
"hr",
|
|
"i",
|
|
"img",
|
|
"li",
|
|
"ol",
|
|
"p",
|
|
"span",
|
|
"strong",
|
|
"table",
|
|
"tbody",
|
|
"td",
|
|
"th",
|
|
"thead",
|
|
"tr",
|
|
"u",
|
|
"ul",
|
|
"blockquote",
|
|
"code",
|
|
"pre",
|
|
"font",
|
|
"center",
|
|
},
|
|
attributes={
|
|
"a": {"href", "title", "target"},
|
|
"img": {"src", "alt", "width", "height"},
|
|
"span": {"style"},
|
|
"div": {"style"},
|
|
"font": {"color", "size", "face"},
|
|
"p": {"style"},
|
|
"td": {"style"},
|
|
"th": {"style"},
|
|
},
|
|
)
|