website/views/blog.py (1)

23-26: Enhancement of Markdown processing with additional extensions.

The addition of the three Markdown extensions (fenced_code, tables, nl2br) greatly improves the rendering capabilities for blog posts. This allows for:

1. Proper rendering of code blocks with syntax highlighting using triple backticks
2. Support for Markdown tables
3. Automatic conversion of newlines to line breaks for better text formatting

These extensions work well with the safe filter added in the template to fix the HTML rendering issue.

For additional security, consider using a HTML sanitization library like bleach to ensure that even with the safe filter, only a whitelist of allowed HTML tags and attributes can be rendered. This would protect against potential XSS attacks while still allowing intended HTML formatting.

 def get_object(self):
     post = super().get_object()
     post.content = markdown.markdown(
         post.content,
         extensions=["markdown.extensions.fenced_code", "markdown.extensions.tables", "markdown.extensions.nl2br"],
     )
+    # Optional: Sanitize HTML content to prevent XSS
+    # import bleach
+    # allowed_tags = ['p', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'a', 'abbr', 'acronym', 'b', 'blockquote', 
+    #                 'code', 'em', 'i', 'li', 'ol', 'ul', 'strong', 'span', 'table', 'tbody', 'td', 
+    #                 'th', 'tr', 'thead', 'br', 'pre']
+    # allowed_attrs = {'a': ['href', 'title'], 'abbr': ['title'], 'acronym': ['title']}
+    # post.content = bleach.clean(post.content, tags=allowed_tags, attributes=allowed_attrs)
     return post

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

website/views/blog.py (5)

31-52: Consider moving the allowed tags list to settings.

The comprehensive list of allowed HTML tags is appropriate for blog content, but consider moving this to a constants file or Django settings for better maintainability and reusability.

- allowed_tags = [
-     "p",
-     "br",
-     "b",
-     "strong",
-     "i",
-     "em",
-     "h1",
-     "h2",
-     "h3",
-     "h4",
-     "h5",
-     "h6",
-     "blockquote",
-     "ul",
-     "ol",
-     "li",
-     "a",
-     "img",
-     "code",
-     "pre",
- ]
+ from django.conf import settings
+ allowed_tags = settings.ALLOWED_HTML_TAGS

Then in settings.py:

ALLOWED_HTML_TAGS = [
    "p", "br", "b", "strong", "i", "em", 
    "h1", "h2", "h3", "h4", "h5", "h6", 
    "blockquote", "ul", "ol", "li", 
    "a", "img", "code", "pre",
]

---

53-59: Consider moving allowed attributes to settings.

Similar to the allowed tags, consider moving the attributes dictionary to settings for better maintainability and reusability.

- allowed_attributes = {
-     "a": ["href", "title", "rel", "target"],
-     "img": ["src", "alt", "title", "width", "height"],
-     "blockquote": ["cite"],
-     "code": ["class"],
-     "pre": ["class"],
- }
+ from django.conf import settings
+ allowed_attributes = settings.ALLOWED_HTML_ATTRIBUTES

---

23-65: Consider separating concerns in the get_object method.

The method is currently handling multiple responsibilities: fetching the object, rendering markdown, and sanitizing HTML. Consider separating these concerns for better maintainability.

def get_object(self):
    post = super().get_object()
-
-    html_content = markdown.markdown(
-        post.content,
-        extensions=["markdown.extensions.fenced_code", "markdown.extensions.tables", "markdown.extensions.nl2br"],
-    )
-
-    allowed_tags = [
-        "p",
-        "br",
-        "b",
-        "strong",
-        "i",
-        "em",
-        "h1",
-        "h2",
-        "h3",
-        "h4",
-        "h5",
-        "h6",
-        "blockquote",
-        "ul",
-        "ol",
-        "li",
-        "a",
-        "img",
-        "code",
-        "pre",
-    ]
-    allowed_attributes = {
-        "a": ["href", "title", "rel", "target"],
-        "img": ["src", "alt", "title", "width", "height"],
-        "blockquote": ["cite"],
-        "code": ["class"],
-        "pre": ["class"],
-    }
-
-    clean_html = bleach.clean(html_content, tags=allowed_tags, attributes=allowed_attributes, strip=True)
-
-    post.content = mark_safe(clean_html)
+    post.content = self._render_and_sanitize_content(post.content)

    return post

+ def _render_and_sanitize_content(self, content):
+     """Render markdown content and sanitize the resulting HTML."""
+     from django.conf import settings
+
+     html_content = markdown.markdown(
+         content,
+         extensions=["markdown.extensions.fenced_code", "markdown.extensions.tables", "markdown.extensions.nl2br"],
+     )
+
+     allowed_tags = getattr(settings, 'ALLOWED_HTML_TAGS', [
+         "p", "br", "b", "strong", "i", "em", 
+         "h1", "h2", "h3", "h4", "h5", "h6", 
+         "blockquote", "ul", "ol", "li", 
+         "a", "img", "code", "pre",
+     ])
+     
+     allowed_attributes = getattr(settings, 'ALLOWED_HTML_ATTRIBUTES', {
+         "a": ["href", "title", "rel", "target"],
+         "img": ["src", "alt", "title", "width", "height"],
+         "blockquote": ["cite"],
+         "code": ["class"],
+         "pre": ["class"],
+     })
+
+     clean_html = bleach.clean(html_content, tags=allowed_tags, attributes=allowed_attributes, strip=True)
+
+     return mark_safe(clean_html)

---

61-61: Consider adding link protocols whitelist for enhanced security.

To further strengthen XSS protection, consider adding allowed protocols to the bleach.clean() call.

- clean_html = bleach.clean(html_content, tags=allowed_tags, attributes=allowed_attributes, strip=True)
+ allowed_protocols = ['http', 'https', 'mailto']
+ clean_html = bleach.clean(html_content, tags=allowed_tags, attributes=allowed_attributes, protocols=allowed_protocols, strip=True)

---

26-29: Consider caching the rendered content for performance.

For long blog posts, the markdown rendering and sanitization process could impact performance. Consider implementing caching for rendered content.

+ from django.core.cache import cache
+ 
def get_object(self):
    post = super().get_object()

+    # Use cache key based on post ID and last modification time
+    cache_key = f"post_content_{post.id}_{post.modified_at.timestamp()}"
+    cached_content = cache.get(cache_key)
+    
+    if cached_content:
+        post.content = cached_content
+        return post
+
    html_content = markdown.markdown(
        post.content,
        extensions=["markdown.extensions.fenced_code", "markdown.extensions.tables", "markdown.extensions.nl2br"],
    )

    # [existing code for sanitization]

    post.content = mark_safe(clean_html)
+    # Cache the content for future requests (set a reasonable timeout)
+    cache.set(cache_key, post.content, timeout=86400)  # 24 hours

    return post

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro