760744 - upgrade to bleach 1.1.2 or latest

Status: RESOLVED FIXED

(support.mozilla.org :: Code Quality, task, P3)

Description

[Will Kahn-Greene [:willkg] ET needinfo? me]

We should upgrade to bleach 1.1.2. From James' email:

    It fixes a hang in a regex with extremely long or
    complex inline styles. If you're on 1.1.x, you should
    upgrade.

I checked vendor and it looks like we're using bleach 1.0.1.

Comment 1

[Michael Cooper [:mythmon]]

I think I got this working, but it needs changes in py-wikimarkup. I'll work with upstream.

Comment 2

[Will Kahn-Greene [:willkg] ET needinfo? me]

What changes does it require?

Comment 3

[Michael Cooper [:mythmon]]

The changes needed are that it needs to specify an alternate tokenizer when calling bleach.linkify, since bleach.linkify by default sanitizes it's input, causing tags we add to the output to get printed as < and > characters. The changes are fairly minor.

Comment 4

[Michael Cooper [:mythmon]]

https://github.com/pcraciunoiu/py-wikimarkup/pull/6

Comment 5

[Will Kahn-Greene [:willkg] ET needinfo? me]

Kadir said anything in the 2012.14 sprint that wasn't IA related should be a P3. Making it so.

Comment 6

[Michael Cooper [:mythmon]]

https://github.com/mozilla/kitsune/pull/722

Comment 7

[Michael Cooper [:mythmon]]

Landed in fa21009

Comment 8

[Will Kahn-Greene [:willkg] ET needinfo? me]

Mike: We usually provide the github url for the commit sha because then it shows fancy things with bugzilljs. So the url for your commit is this one:

https://github.com/mozilla/kitsune/commit/fa2100902e4e539018c1865136a9ae8b16b9b4be

Additionally, we don't mark the bug as resolved until after it's been pushed to production. That reduces the likelihood that someone who's cc:d on the bug sees it closed, checks production, sees it still broken, reopens the bug, and then we have to explain the confusion. That's too much work. Easier to just mark it resolved after it's pushed to production.