From 6d14e55ab7072d6f17cc1acbd09d460a3a8596a7 Mon Sep 17 00:00:00 2001
From: Marcin Kuzminski <marcin@rhodecode.com>
Date: Fri, 15 Feb 2019 11:53:48 +0000
Subject: [PATCH] security: sanitize plaintext renderer with bleach.

---
 rhodecode/lib/markup_renderer.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/rhodecode/lib/markup_renderer.py b/rhodecode/lib/markup_renderer.py
index ccccae9a..e0ad0f61 100644
--- a/rhodecode/lib/markup_renderer.py
+++ b/rhodecode/lib/markup_renderer.py
@@ -357,7 +357,9 @@ class MarkupRenderer(object):
         if leading_newline:
             source += '<br />'
         source += rendered_source.replace("\n", '<br />')
-        return source
+
+        rendered = cls.bleach_clean(source)
+        return rendered
 
     @classmethod
     def markdown(cls, source, safe=True, flavored=True, mentions=False,