Sanitize HTML in templates using utils

We can no longer trust that the content of templates stored in the
database is safe.

Utils now has code to sanitise the content of templates.

This commit:
- updates utils to bring this code in
- modifies some integration tests to make sure everything is working
  (there are more extensive unit tests in utils)

tests/app/main/views/test_jobs.py

@@ -112,7 +112,7 @@ def test_should_show_page_for_one_job(
         page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
         assert page.h1.text.strip() == 'thisisatest.csv'
         assert page.find('div', {'class': 'sms-message-wrapper'}).text.strip() == (
-            '{}: Your vehicle tax is about to expire'.format(service_one['name'])
+            '{}: Template <em>content</em> with & entity'.format(service_one['name'])
         )
         assert ' '.join(page.find('tbody').find('tr').text.split()) == (
             '07123456789 Delivered 1 January at 11:10am'

tests/app/main/views/test_send.py

@@ -479,7 +479,7 @@ def test_should_show_preview_letter_message(
     mock_get_service_letter_template.assert_called_with(service_id, template_id)
     assert mock_letter_preview.call_args[0][0]['message'] == (
         '<h2>Subject</h2>\n'
-        '<p>Your vehicle tax is about to expire</p>'
+        '<p>Template &lt;em&gt;content&lt;/em&gt; with &amp; entity</p>'
     )
 
 

tests/app/main/views/test_templates.py

@@ -35,7 +35,7 @@ def test_should_show_page_for_one_template(
 
     assert response.status_code == 200
     assert "Two week reminder" in response.get_data(as_text=True)
-    assert "Your vehicle tax is about to expire" in response.get_data(as_text=True)
+    assert "Template <em>content</em> with & entity" in response.get_data(as_text=True)
     assert "Use priority queue?" not in response.get_data(as_text=True)
     mock_get_service_template.assert_called_with(
         service_id, template_id)
@@ -63,7 +63,7 @@ def test_should_show_page_template_with_priority_select_if_platform_admin(
 
     assert response.status_code == 200
     assert "Two week reminder" in response.get_data(as_text=True)
-    assert "Your vehicle tax is about to expire" in response.get_data(as_text=True)
+    assert "Template <em>content</em> with & entity" in response.get_data(as_text=True)
     assert "Use priority queue?" in response.get_data(as_text=True)
     mock_get_service_template.assert_called_with(
         service_id, template_id)
@@ -419,7 +419,7 @@ def test_should_show_delete_template_page_with_time_block(app_,
     assert 'Test template was last used 10 minutes ago. Are you sure you want to delete it?' in content
     assert 'Are you sure' in content
     assert 'Two week reminder' in content
-    assert 'Your vehicle tax is about to expire' in content
+    assert 'Template <em>content</em> with & entity' in content
     mock_get_service_template.assert_called_with(service_id, template_id)
 
 
@@ -453,7 +453,7 @@ def test_should_show_delete_template_page_with_never_used_block(app_,
             assert 'Two week reminder has never been used. Are you sure you want to delete it?' in content
             assert 'Are you sure' in content
             assert 'Two week reminder' in content
-            assert 'Your vehicle tax is about to expire' in content
+            assert 'Template <em>content</em> with & entity' in content
             mock_get_service_template.assert_called_with(service_id, template_id)