feat: use nh3 for HTML sanitization

ietf/doc/templatetags/ietf_filters.py

@@ -11,7 +11,7 @@
 from django import template
 from django.conf import settings
 from django.utils.html import escape
-from django.template.defaultfilters import truncatewords_html, linebreaksbr, stringfilter, striptags
+from django.template.defaultfilters import truncatewords_html, linebreaksbr, stringfilter, striptags, urlize
 from django.utils.safestring import mark_safe, SafeData
 from django.utils.html import strip_tags
 from django.utils.encoding import force_str
@@ -29,7 +29,7 @@
 from ietf.utils import log
 from ietf.doc.utils import prettify_std_name
 from ietf.utils.html import clean_html
-from ietf.utils.text import wordwrap, fill, wrap_text_if_unwrapped, linkify
+from ietf.utils.text import wordwrap, fill, wrap_text_if_unwrapped
 from ietf.utils.validators import validate_url
 
 register = template.Library()
@@ -448,14 +448,14 @@ def ad_area(user):
 def format_history_text(text, trunc_words=25):
     """Run history text through some cleaning and add ellipsis if it's too long."""
     full = mark_safe(clean_html(text))
-    full = linkify(urlize_ietf_docs(full))
+    full = urlize(urlize_ietf_docs(full))
 
     return format_snippet(full, trunc_words)
 
 @register.filter
 def format_snippet(text, trunc_words=25): 
     # urlize if there aren't already links present
-    text = linkify(text)
+    text = urlize(text)
     full = keep_spacing(collapsebr(linebreaksbr(mark_safe(clean_html(text)))))
     snippet = truncatewords_html(full, trunc_words)
     if snippet != full:
@@ -714,10 +714,6 @@ def rfcbis(s):
     m = re.search(r'^.*-rfc(\d+)-?bis(-.*)?$', s)
     return None if m is None else 'rfc' + m.group(1) 
 
-@register.filter
-@stringfilter
-def urlize(value):
-    raise RuntimeError("Use linkify from textfilters instead of urlize")
 
 @register.filter
 @stringfilter

ietf/group/tests_info.py

@@ -5,7 +5,6 @@
 import calendar
 import datetime
 import io
-import bleach
 from unittest import mock
 
 from unittest.mock import call, patch
@@ -47,6 +46,7 @@
 from ietf.utils.mail import outbox, empty_outbox, get_payload_text
 from ietf.utils.test_utils import login_testing_unauthorized, TestCase, unicontent, reload_db_objects
 from ietf.utils.timezone import date_today, DEADLINE_TZINFO
+from django.template.defaultfilters import urlize
 
 
 def group_urlreverse_list(group, viewname):
@@ -2141,7 +2141,7 @@ def test_view_status_update(self):
             response = self.client.get(url)
             self.assertEqual(response.status_code,200)
             q=PyQuery(response.content)
-            self.assertTrue(bleach.linkify(escape(event.desc), parse_email=True) in str(q('pre')))
+            self.assertTrue(urlize(escape(event.desc)) in str(q('pre')))
             self.assertFalse(q('a#edit_button'))
             self.client.login(username=chair.person.user.username,password='%s+password'%chair.person.user.username)
             response = self.client.get(url)

ietf/name/fixtures/names.json

@@ -12807,7 +12807,7 @@
   {
     "fields": {
       "default_offset_days": -57,
-      "desc": "Cut-off date for BOF proposal requests. To request a __BoF__ session use the [IETF BoF Request Tool](/doc/bof-requests).",
+      "desc": "",
       "name": "Cut-off preliminary BOF requests",
       "order": 0,
       "used": true
@@ -12818,7 +12818,7 @@
   {
     "fields": {
       "default_offset_days": -57,
-      "desc": "Preliminary BOF proposals requested. To request a __BoF__ session use the [IETF BoF Request Tool](/doc/bof-requests).",
+      "desc": "",
       "name": "Preliminary BOF proposals requested",
       "order": 0,
       "used": false
@@ -12851,7 +12851,7 @@
   {
     "fields": {
       "default_offset_days": -43,
-      "desc": "Cut-off date for BOF proposal requests to Area Directors at UTC 23:59. To request a __BoF__ session use the [IETF BoF Request Tool](/doc/bof-requests).",
+      "desc": "",
       "name": "Cut-off BOF scheduling Requests",
       "order": 0,
       "used": false
@@ -12895,7 +12895,7 @@
   {
     "fields": {
       "default_offset_days": -43,
-      "desc": "Cut-off date for requests to schedule Working Group Meetings at UTC 23:59. To request a __Working Group__ session, use the [IETF Meeting Session Request Tool](/secr/sreq/).",
+      "desc": "",
       "name": "Cut-off WG scheduling Requests",
       "order": 0,
       "used": true
@@ -12950,7 +12950,7 @@
   {
     "fields": {
       "default_offset_days": -12,
-      "desc": "Internet-Draft submission cut-off (for all Internet-Drafts, including -00) by UTC 23:59. Upload using the [I-D Submission Tool](/submit/).",
+      "desc": "",
       "name": "I-D Cutoff",
       "order": 0,
       "used": true
@@ -12983,7 +12983,7 @@
   {
     "fields": {
       "default_offset_days": -82,
-      "desc": "IETF Online Registration Opens [Register Here](https://www.ietf.org/how/meetings/register/).",
+      "desc": "",
       "name": "Registration Opens",
       "order": 0,
       "used": true
@@ -12994,7 +12994,7 @@
   {
     "fields": {
       "default_offset_days": -89,
-      "desc": "Working Group and BOF scheduling begins. To request a Working Group session, use the [IETF Meeting Session Request Tool](/secr/sreq/). If you are working on a BOF request, it is highly recommended to tell the IESG now by sending an [email to iesg@ietf.org](mailtp:iesg@ietf.org) to get advance help with the request.",
+      "desc": "",
       "name": "Scheduling Opens",
       "order": 0,
       "used": true

ietf/name/migrations/0020_alter_important_dates.py

@@ -0,0 +1,17 @@
+# Copyright The IETF Trust 2026, All Rights Reserved
+
+from django.db import migrations
+
+def reverse_markdown(apps, schema_editor):
+    ImportantDateName = apps.get_model("name", "ImportantDateName")
+    slugs = ["bofproposals", "openreg", "opensched", "cutoffwgreq", "idcutoff", "cutoffwgreq", "bofprelimcutoff", "cutoffbofreq"]
+    ImportantDateName.objects.filter(pk__in=slugs).update(desc="")
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("name", "0019_alter_sessionpurposename_timeslot_types"),
+    ]
+
+    operations = [
+        migrations.RunPython(reverse_markdown),
+    ]

ietf/templates/doc/charter/submit.html

@@ -68,18 +68,18 @@ <h1>Charter submission</h1>
                 <tr>
                     <th scope="row">Mailing list</th>
                     <th scope="row">Address</th>
-                    <td>{{ group.list_email|linkify }}</td>
+                    <td>{{ group.list_email|urlize }}</td>
                 </tr>
                 <tr>
                     <td></td>
                     <th scope="row">To subscribe</th>
-                    <td>{{ group.list_subscribe|linkify }}</td>
+                    <td>{{ group.list_subscribe|urlize }}</td>
                 </tr>
                 <tr>
                     <td></td>
                     <th scope="row">Archive</th>
                     <td>
-                        {{ group.list_archive|linkify }}
+                        {{ group.list_archive|urlize }}
                     </td>
                 </tr>
             </tbody>

ietf/templates/doc/document_ballot_content.html

@@ -133,7 +133,7 @@
                                 </div>
                             </div>
                             <div class="card-body">
-                                <pre class="ballot pasted">{{ p.discuss|escape|urlize_ietf_docs|linkify }}</pre>
+                                <pre class="ballot pasted">{{ p.discuss|escape|urlize_ietf_docs|urlize }}</pre>
                             </div>
                         </div>
                     {% endif %}
@@ -167,7 +167,7 @@
                                 </div>
                             </div>
                             <div class="card-body">
-                                <pre class="ballot pasted">{{ p.comment|escape|urlize_ietf_docs|linkify }}</pre>
+                                <pre class="ballot pasted">{{ p.comment|escape|urlize_ietf_docs|urlize }}</pre>
                             </div>
                         </div>
                     {% endif %}
@@ -231,11 +231,11 @@
                         </div>
                         {% if p.pos.blocking and p.discuss %}
                             <div class="card-body">
-                                <pre class="ballot pasted">{{ p.discuss|escape|urlize_ietf_docs|linkify }}</pre>
+                                <pre class="ballot pasted">{{ p.discuss|escape|urlize_ietf_docs|urlize }}</pre>
                             </div>
                         {% else %}
                             <div class="card-body">
-                                <pre class="ballot pasted">{{ p.comment|escape|urlize_ietf_docs|linkify }}</pre>
+                                <pre class="ballot pasted">{{ p.comment|escape|urlize_ietf_docs|urlize }}</pre>
                             </div>
                         {% endif %}
                     </div>

ietf/templates/doc/document_conflict_review.html

@@ -109,7 +109,7 @@
                         </a>
                     {% endif %}
                 </td>
-                <td>{{ doc.notify|linkify }}</td>
+                <td>{{ doc.notify|urlize }}</td>
             </tr>
         </tbody>
     </table>
@@ -135,7 +135,7 @@
                 {{ doc.name }}-{{ doc.rev }}
             </div>
             <div class="card-body">
-                <pre>{{ content|maybewordwrap|urlize_ietf_docs|linkify }}</pre>
+                <pre>{{ content|maybewordwrap|urlize_ietf_docs|urlize }}</pre>
             </div>
         </div>
     {% endif %}

ietf/templates/doc/document_draft.html

@@ -424,7 +424,7 @@
                                 {# IESG Notes are historic and read-only now #}
                             </td>
                             <td>
-                                {{ doc.notedoc.note|urlize_ietf_docs|linkify|linebreaksbr }}
+                                {{ doc.notedoc.note|urlize_ietf_docs|urlize|linebreaksbr }}
                             </td>
                         </tr>
                     {% endif %}
@@ -443,7 +443,7 @@
                         </td>
                         <td>
                             {% if doc.notify %}
-                                {{ doc.notify|linkify }}
+                                {{ doc.notify|urlize }}
                             {% else %}
                                 <span class="text-body-secondary">
                                     (None)

ietf/templates/doc/document_email.html

@@ -51,12 +51,12 @@ <h2 class="my-3">Recipient expansions</h2>
                     </td>
                     <td>
                         {% for addr in to %}
-                            {{ addr|linkify }}{% if not forloop.last %}, {% endif %}
+                            {{ addr|urlize }}{% if not forloop.last %}, {% endif %}
                         {% endfor %}
                     </td>
                     <td>
                         {% for addr in cc %}
-                            {{ addr|linkify }}{% if not forloop.last %}, {% endif %}
+                            {{ addr|urlize }}{% if not forloop.last %}, {% endif %}
                         {% endfor %}
                     </td>
                 </tr>

ietf/templates/doc/document_material.html

@@ -128,7 +128,7 @@
                                             <i class="bi bi-people"></i>
                                         </a>
                                     {% endif %}
-                                    {{ pres.session.remote_instructions|linkify }}
+                                    {{ pres.session.remote_instructions|urlize }}
                                     {% if not forloop.last %}<br>{% endif %}
                                 {% endfor %}
                             {% else %}
@@ -163,7 +163,7 @@
                 {% if content_is_html %}
                     {{ content|sanitize|safe }}
                 {% else %}
-                    <pre>{{ content|maybewordwrap|urlize_ietf_docs|linkify }}</pre>
+                    <pre>{{ content|maybewordwrap|urlize_ietf_docs|urlize }}</pre>
                 {% endif %}
             {% else %}
                 Not available as plain text.

ietf/templates/doc/document_review.html

@@ -53,7 +53,7 @@
         <div class="card mt-5">
             <div class="card-header">{{ doc.name }}-{{ doc.rev }}</div>
             <div class="card-body">
-                <pre class="pasted">{{ content|maybewordwrap|urlize_ietf_docs|linkify }}</pre>
+                <pre class="pasted">{{ content|maybewordwrap|urlize_ietf_docs|urlize }}</pre>
             </div>
         </div>
     {% endif %}

ietf/templates/doc/document_rfc.html

@@ -70,7 +70,7 @@
                         </td>
                         <td>
                             {% if doc.notify %}
-                                {{ doc.notify|linkify }}
+                                {{ doc.notify|urlize }}
                             {% else %}
                                 <span class="text-body-secondary">
                                     (None)

ietf/templates/doc/document_status_change.html

@@ -125,7 +125,7 @@
                     {% endif %}
                 </td>
                 <td>
-                    {{ doc.notify|linkify }}
+                    {{ doc.notify|urlize }}
                 </td>
             </tr>
         </tbody>
@@ -162,7 +162,7 @@
                 {{ doc.name }}-{{ doc.rev }}
             </div>
             <div class="card-body">
-                <pre>{{ content|maybewordwrap|urlize_ietf_docs|linkify }}</pre>
+                <pre>{{ content|maybewordwrap|urlize_ietf_docs|urlize }}</pre>
             </div>
         </div>
     {% endif %}

ietf/templates/doc/document_writeup.html

@@ -17,7 +17,7 @@ <h2 class="my-3">
         </h2>
         {% for name, text, url in writeups %}
             {% if name %}<h3 class="mt-5">{{ name }}</h3>{% endif %}
-            {% if text %}<pre class="border p-3 my-3">{{ text|urlize_ietf_docs|linkify }}</pre>{% endif %}
+            {% if text %}<pre class="border p-3 my-3">{{ text|urlize_ietf_docs|urlize }}</pre>{% endif %}
             {% if can_edit %}
                 <p>
                     <a href="{{ url }}" class="btn btn-primary">

ietf/templates/doc/review/complete_review.html

@@ -66,7 +66,7 @@ <h1>
         </p>
         <p>
             If you enter the review below, the review will be sent
-            to {% for addr in review_to %}{{ addr|linkify }}{% if not forloop.last %}, {% endif %}{% endfor %}{% if review_cc %}, with a CC to {% for addr in review_cc %}{{ addr|linkify }}{% if not forloop.last %}, {% endif %}{% endfor %}{% endif %}.
+            to {% for addr in review_to %}{{ addr|urlize }}{% if not forloop.last %}, {% endif %}{% endfor %}{% if review_cc %}, with a CC to {% for addr in review_cc %}{{ addr|urlize }}{% if not forloop.last %}, {% endif %}{% endfor %}{% endif %}.
         </p>
     {% elif assignment %}
         <p>

ietf/templates/doc/shepherd_writeup.html

@@ -11,7 +11,7 @@ <h1>
         <br>
         <small class="text-body-secondary">{{ doc.name }}</small>
     </h1>
-    <pre class="border p-3 my-3">{{writeup|maybewordwrap|urlize_ietf_docs|linkify}}</pre>
+    <pre class="border p-3 my-3">{{writeup|maybewordwrap|urlize_ietf_docs|urlize}}</pre>
     {% if can_edit %}
         <a class="btn btn-primary"
            href="{% url 'ietf.doc.views_draft.edit_shepherd_writeup' name=doc.name %}">Edit</a>

ietf/templates/doc/shepherd_writeup_template.html

@@ -1,10 +1,9 @@
 {% extends "base.html" %}
 {# Copyright The IETF Trust 2015, All Rights Reserved #}
 {% load origin %}
-{% load ietf_filters %}
-{% load textfilters htmlfilters %}
+{% load ietf_filters static textfilters htmlfilters %}
 {% block title %}Document Shepherd Write-Up{% if type == "group" %} for Group Documents{% elif type == "individual" %} for Individual Documents{% endif %}{% endblock %}
 {% block content %}
     {% origin %}
-    {{ writeup|urlize_ietf_docs|linkify }}
+    {{ writeup|urlize_ietf_docs }}
 {% endblock %}

ietf/templates/doc/state_help.html

@@ -26,7 +26,7 @@ <h1>{{ title }}</h1>
             {% for state in states %}
                 <tr id="{{ state.slug|default:"idexists" }}">
                     <th scope="row">{{ state.name }}</th>
-                    <td>{{ state.desc|safe|urlize_ietf_docs|linkify }}</td>
+                    <td>{{ state.desc|safe|urlize_ietf_docs|urlize }}</td>
                     {% if has_next_states %}
                         <td>
                             {% for s in state.next_states.all %}

ietf/templates/group/active_areas.html

@@ -69,7 +69,7 @@ <h2 class="mt-5" id="id-{{ area.acronym|slugify }}">
         </h2>
         {% if area.description %}
             <p>
-                {{ area.description|urlize_ietf_docs|linkify|safe }}
+                {{ area.description|urlize_ietf_docs|urlize|safe }}
             </p>
         {% endif %}
         {% include "group/group_stats_modal.html" with group=area only %}

ietf/templates/group/all_status.html

@@ -22,7 +22,7 @@ <h2 class="mt-3">{{ area_item.grouper.name }} ({{ area_item.grouper.acronym|uppe
                     {{ rpt.time|date:"Y-m-d" }}
                 </div>
                 <div class="card-body">
-                    <pre class="pasted">{{ rpt.desc|default:"(none)"|urlize_ietf_docs|linkify }}</pre>
+                    <pre class="pasted">{{ rpt.desc|default:"(none)"|urlize_ietf_docs|urlize }}</pre>
                 </div>
             </div>
         {% endfor %}
@@ -38,7 +38,7 @@ <h2 class="mt-3">Internet Research Task Force (IRTF)</h2>
                 {{ rpt.time|date:"Y-m-d" }}
             </div>
             <div class="card-body">
-                <pre class="pasted">{{ rpt.desc|default:"(none)"|urlize_ietf_docs|linkify }}</pre>
+                <pre class="pasted">{{ rpt.desc|default:"(none)"|urlize_ietf_docs|urlize }}</pre>
             </div>
         </div>
     {% endfor %}