fix calendar display on uniweb, sanitize source desc.

.isort.cfg

@@ -3,4 +3,4 @@
 line_length = 88
 multi_line_output = 3
 include_trailing_comma = true
-known_third_party = PyPDF2,arrow,bleach,bs4,captcha,celery,dateutil,django,environ,faker,fastjsonschema,httplib2,icalendar,instaloader,markdown,modelcluster,pirates,pytest,pytz,requests,sentry_sdk,taggit,wagtail,wagtailmetadata,weasyprint,willow,yaml
+known_third_party = PyPDF2,arrow,bleach,bs4,captcha,celery,dateutil,django,environ,faker,fastjsonschema,httplib2,icalendar,instaloader,markdown,modelcluster,nh3,pirates,pytest,pytz,requests,sentry_sdk,taggit,wagtail,wagtailmetadata,weasyprint,willow,yaml

calendar_utils/parser.py

@@ -4,6 +4,7 @@ from zoneinfo import ZoneInfo
 
 import arrow
 import bleach
+import nh3
 from django.conf import settings
 from django.utils.timezone import is_naive
 
@@ -61,6 +62,12 @@ def process_event(event: "Event") -> dict:
     event = set_event_timezone(event)
     event = set_event_duration(event)
     event = set_event_description(event)
+
+    event.description = nh3.clean(
+        event.description,
+        tags={"h1", "h2", "h3", "h4", "h5", "h6", "a", "em", "p", "b", "strong", "br"},
+    )
+
     # for event in sorted(cal.events, key=attrgetter("start"), reverse=True): TODO check
     return {key: getattr(event, key) for key in EVENT_KEYS}
 

requirements/base.in

@@ -31,3 +31,4 @@ wand
 httplib2<0.21.0,>=0.20.4
 icalendar==4.0.9
 pytz<2022.0,>=2021.3
+nh3

requirements/base.txt

@@ -12,7 +12,7 @@ arrow==1.3.0
     # via
     #   -r base.in
     #   ics
-asgiref==3.7.2
+asgiref==3.8.1
     # via django
 asttokens==2.4.1
     # via stack-data
@@ -35,7 +35,7 @@ brotli==1.1.0
     # via fonttools
 cattrs==23.2.3
     # via requests-cache
-celery==5.3.6
+celery==5.4.0
     # via -r base.in
 certifi==2024.2.2
     # via
@@ -53,13 +53,13 @@ click==8.1.7
     #   click-didyoumean
     #   click-plugins
     #   click-repl
-click-didyoumean==0.3.0
+click-didyoumean==0.3.1
     # via celery
 click-plugins==1.1.1
     # via celery
 click-repl==0.3.0
     # via celery
-cryptography==42.0.4
+cryptography==42.0.5
     # via
     #   josepy
     #   mozilla-django-oidc
@@ -108,7 +108,7 @@ django-treebeard==4.7.1
     # via wagtail
 django-widget-tweaks==1.5.0
     # via -r base.in
-djangorestframework==3.14.0
+djangorestframework==3.15.1
     # via wagtail
 draftjs-exporter==2.1.7
     # via wagtail
@@ -118,7 +118,7 @@ executing==2.0.1
     # via stack-data
 fastjsonschema==2.19.1
     # via -r base.in
-fonttools[woff]==4.49.0
+fonttools[woff]==4.51.0
     # via weasyprint
 html5lib==1.1
     # via
@@ -130,24 +130,26 @@ icalendar==4.0.9
     # via -r base.in
 ics==0.7.2
     # via -r base.in
-idna==3.6
+idna==3.7
     # via requests
-ipython==8.21.0
+ipython==8.23.0
     # via -r base.in
 jedi==0.19.1
     # via ipython
 josepy==1.14.0
     # via mozilla-django-oidc
-kombu==5.3.5
+kombu==5.3.7
     # via celery
 l18n==2021.3
     # via wagtail
-markdown==3.5.2
+markdown==3.6
     # via -r base.in
-matplotlib-inline==0.1.6
+matplotlib-inline==0.1.7
     # via ipython
 mozilla-django-oidc==3.0.0
     # via pirates
+nh3==0.2.17
+    # via -r base.in
 numpy==1.26.4
     # via opencv-python
 oauthlib==3.2.2
@@ -158,7 +160,7 @@ opencv-python==4.9.0.80
     # via -r base.in
 openpyxl==3.1.2
     # via wagtail
-parso==0.8.3
+parso==0.8.4
     # via jedi
 pexpect==4.9.0
     # via ipython
@@ -181,21 +183,21 @@ ptyprocess==0.7.0
     # via pexpect
 pure-eval==0.2.2
     # via stack-data
-pycparser==2.21
+pycparser==2.22
     # via cffi
-pydyf==0.8.0
+pydyf==0.9.0
     # via weasyprint
 pygments==2.17.2
     # via ipython
-pyopenssl==24.0.0
+pyopenssl==24.1.0
     # via josepy
-pyparsing==3.1.1
+pyparsing==3.1.2
     # via httplib2
 pypdf2==3.0.1
     # via -r base.in
 pyphen==0.14.0
     # via weasyprint
-python-dateutil==2.8.2
+python-dateutil==2.9.0.post0
     # via
     #   arrow
     #   celery
@@ -205,12 +207,11 @@ pytz==2021.3
     # via
     #   -r base.in
     #   django-modelcluster
-    #   djangorestframework
     #   icalendar
     #   l18n
 pyyaml==6.0.1
     # via -r base.in
-redis==5.0.1
+redis==5.0.3
     # via django-redis
 requests==2.31.0
     # via
@@ -224,7 +225,7 @@ requests-cache==1.2.0
     # via -r base.in
 requests-oauthlib==1.3.1
     # via tweepy
-sentry-sdk==1.40.5
+sentry-sdk==1.45.0
     # via -r base.in
 six==1.16.0
     # via
@@ -237,11 +238,11 @@ six==1.16.0
     #   url-normalize
 soupsieve==2.5
     # via beautifulsoup4
-sqlparse==0.4.4
+sqlparse==0.5.0
     # via django
 stack-data==0.6.3
     # via ipython
-tatsu==5.11.3
+tatsu==5.12.0
     # via ics
 telepath==0.3.1
     # via wagtail
@@ -249,14 +250,16 @@ tinycss2==1.2.1
     # via
     #   cssselect2
     #   weasyprint
-traitlets==5.14.1
+traitlets==5.14.2
     # via
     #   ipython
     #   matplotlib-inline
 tweepy==4.14.0
     # via -r base.in
-types-python-dateutil==2.8.19.20240106
+types-python-dateutil==2.9.0.20240316
     # via arrow
+typing-extensions==4.11.0
+    # via ipython
 tzdata==2024.1
     # via celery
 url-normalize==1.4.3
@@ -284,7 +287,7 @@ wand==0.6.13
     # via -r base.in
 wcwidth==0.2.13
     # via prompt-toolkit
-weasyprint==61.0
+weasyprint==61.2
     # via -r base.in
 webencodings==0.5.1
     # via

requirements/dev.txt

@@ -4,9 +4,9 @@
 #
 #    pip-compile dev.in
 #
-asgiref==3.7.2
+asgiref==3.8.1
     # via django
-coverage[toml]==7.4.2
+coverage[toml]==7.4.4
     # via pytest-cov
 django==4.1.13
     # via
@@ -16,7 +16,7 @@ django-debug-toolbar==4.3.0
     # via -r dev.in
 factory-boy==3.3.0
     # via pytest-factoryboy
-faker==23.2.1
+faker==24.11.0
     # via factory-boy
 fastdiff==0.3.0
     # via snapshottest
@@ -26,13 +26,14 @@ inflection==0.5.1
     # via pytest-factoryboy
 iniconfig==2.0.0
     # via pytest
-packaging==23.2
+packaging==24.0
     # via
     #   pytest
+    #   pytest-factoryboy
     #   pytest-sugar
 pluggy==1.4.0
     # via pytest
-pytest==8.0.1
+pytest==8.1.1
     # via
     #   -r dev.in
     #   pytest-cov
@@ -41,19 +42,19 @@ pytest==8.0.1
     #   pytest-freezegun
     #   pytest-mock
     #   pytest-sugar
-pytest-cov==4.1.0
+pytest-cov==5.0.0
     # via -r dev.in
 pytest-django==4.8.0
     # via -r dev.in
-pytest-factoryboy==2.6.0
+pytest-factoryboy==2.7.0
     # via -r dev.in
 pytest-freezegun==0.4.2
     # via -r dev.in
-pytest-mock==3.12.0
+pytest-mock==3.14.0
     # via -r dev.in
 pytest-sugar==1.0.0
     # via -r dev.in
-python-dateutil==2.8.2
+python-dateutil==2.9.0.post0
     # via
     #   faker
     #   freezegun
@@ -63,7 +64,7 @@ six==1.16.0
     #   snapshottest
 snapshottest==0.6.0
     # via -r dev.in
-sqlparse==0.4.4
+sqlparse==0.5.0
     # via
     #   django
     #   django-debug-toolbar
@@ -71,7 +72,7 @@ termcolor==2.4.0
     # via
     #   pytest-sugar
     #   snapshottest
-typing-extensions==4.9.0
+typing-extensions==4.11.0
     # via pytest-factoryboy
 wasmer==1.1.0
     # via fastdiff

requirements/production.txt

@@ -4,7 +4,7 @@
 #
 #    pip-compile production.in
 #
-gunicorn==21.2.0
+gunicorn==22.0.0
     # via -r production.in
-packaging==23.2
+packaging==24.0
     # via gunicorn

uniweb/templates/uniweb/blocks/calendar_agenda.html

@@ -12,8 +12,9 @@
         <div class="col-span-3 md:col-span-2 mt-4 md:mt-0">
           <strong class="block">{{ event.summary }}</strong>
           {% if event.description %}
-            <p class="font-light text-sm mt-1 ">{{ event.description }}</p>
+            <p class="font-light text-sm mt-1 ">{{ event.description|safe }}</p>
           {% endif %}
+
           {% if event.location %}
             <p class="font-light text-sm mt-1">{{ event.location }}</p>
           {% endif %}