diff --git a/lti_consumer/lti_xblock.py b/lti_consumer/lti_xblock.py index aae2678df3d7151f31fc485d0aeaa0f35f135846..3fe04ff78a1305b576f4e1a1328ce0b8b317eb16 100644 --- a/lti_consumer/lti_xblock.py +++ b/lti_consumer/lti_xblock.py @@ -1585,7 +1585,7 @@ class LtiConsumerXBlock(StudioEditableXBlockMixin, XBlock): # For more context on ALLOWED_TAGS and ALLOWED_ATTRIBUTES # Look into this documentation URL see https://bleach.readthedocs.io/en/latest/clean.html#allowed-tags-tags # This lets all plaintext through. - allowed_tags = bleach.sanitizer.ALLOWED_TAGS + ['img'] + allowed_tags = bleach.sanitizer.ALLOWED_TAGS | {'img'} allowed_attributes = dict(bleach.sanitizer.ALLOWED_ATTRIBUTES, **{'img': ['src', 'alt']}) sanitized_comment = bleach.clean(self.score_comment, tags=allowed_tags, attributes=allowed_attributes) diff --git a/lti_consumer/templatetags/lti_sanitize.py b/lti_consumer/templatetags/lti_sanitize.py index 35caaebfa737811d5ff9857b47595e72e24ce24f..bbb73f170a4524acf7ee09d3f5dd9f5c084e1e75 100644 --- a/lti_consumer/templatetags/lti_sanitize.py +++ b/lti_consumer/templatetags/lti_sanitize.py @@ -13,7 +13,7 @@ def lti_sanitize(html): """ Sanitize a html fragment with bleach. """ - allowed_tags = bleach.sanitizer.ALLOWED_TAGS + ['img'] + allowed_tags = bleach.sanitizer.ALLOWED_TAGS | {'img'} allowed_attributes = dict(bleach.sanitizer.ALLOWED_ATTRIBUTES, **{'img': ['src', 'alt']}) sanitized_html = bleach.clean(html, tags=allowed_tags, attributes=allowed_attributes) return mark_safe(sanitized_html)