Upgrade to Bleach 1.5, to limit link schemes to an allowlist

[cuibonobo]

The 1.5 version of Bleach made the allowed protocols configurable: http://bleach.readthedocs.io/en/latest/clean.html#allowed-protocols-protocols

Once the dependency is updated, the safe_markup function in the mailer can be updated and these lines can be uncommented:

synapse/synapse/push/mailer.py

Lines 76 to 77 in 42b5048

	# When bleach release a version with this option, we can specify schemes
	# ALLOWED_SCHEMES = ["http", "https", "ftp", "mailto"]

[MadLittleMods]

It looks like we're already using v2:

synapse/poetry.lock

Line 963 in 6ff99e3

bleach = ">=2.1.0"

And we just have a slightly broader version defined in pyproject.toml (docs):

synapse/pyproject.toml

Line 144 in 6ff99e3

bleach = ">=1.4.3"

Can we bump the minimum version to 1.5 to make the proposed change? What determines our minimums? Do we just ask our packagers?

[DMRobertson]

It looks like we're already using v2:

The bit of the lockfile you quoted refers to the dependencies of the readme-renderer package (whatever that is). We've actually locked 4.1.0:

synapse/poetry.lock

Lines 83 to 89 in 6ff99e3

	[[package]]
	name = "bleach"
	version = "4.1.0"
	description = "An easy safelist-based HTML-sanitizing tool."
	category = "main"
	optional = false
	python-versions = ">=3.6"

but it might be easier to spot this by looking at the locked checksums:

synapse/poetry.lock

Lines 1618 to 1621 in 6ff99e3

	bleach = [
	{file = "bleach-4.1.0-py2.py3-none-any.whl", hash = "sha256:4d2651ab93271d1129ac9cbc679f524565cc8a1b791909c4a51eac4446a15994"},
	{file = "bleach-4.1.0.tar.gz", hash = "sha256:0900d8b37eba61a802ee40ac0061f8c2b5dee29c1927dd1d233e075ebf5a71da"},
	]

A note of caution: the lockfile only describes the contents of

• our docker images
• our Debian packages
• anyone installing using the poetry lockfile

It doesn't cover:

• third party images or packages
• anyone installing from PyPI (pip install matrix-synapse).

What determines our minimums? Do we just ask our packagers?

Pretty much. I sometimes use pkgs.org as a santiy check too, e.g. here and here.

[DMRobertson]

The packagers don't seem to have any objections.

If anyone wants to pick this up, the steps are:

• Raise the lower bound on bleach in pyproject.toml
• Run poetry lock --no-update
• Uncomment the lines containing ALLOWED_SCHEMES
• Ideally: add a test case (or otherwise) demonstrate that safe_markup makes use of the this schema allowlist.