Bleach is deprecated

[suspectpart]

When checking for whether issue #5967 is resolved yet, I stumbled across this code:

seahub/seahub/wiki/views.py

Line 61 in 59c0a80

html_content = bleach.clean(html_content, markdown_tags, markdown_attrs)

We also used bleach on an internal project, unfortunately it is being deprecated (mozilla/bleach#698), stating:

Bleach sits on top of--and heavily relies on--html5lib which is no longer in active development. It is increasingly difficult to maintain Bleach in that context and I think it's nuts to build a security library on top of a library that's not in active development.

It seems like the maintainer of bleach still tries to keep up with patching security issues, but the whole foundation is unmaintained and seems a security risk; is there any plan on your side to replace that dependency with something more actively maintained? In the discussion of the deprecation ticket there seem to be some ideas of other libraries that could handle sanitizing HTML...

[freeplant]

Thanks for reporting the issue. We will give it a check.