Strip HTML from template content

Templates are created in the admin app and persisted in the API.

They are consumed:
- in the admin app, by requesting them from the API
- in the API, by loading them from the database

There are two potential places where unescaped HTML could be sent to a user:
- when the admin app is previewing a template (it has to render the template as
  markup in order to show the placeholders)
- in the body of an email

For all consumers to have confidence that the templates are safe, it makes sense
to santitise them at the point of creation (and modification). This also avoids
any performance issues that could come from doing it at the point of requesting
a template.

In the future they could be created by a direct API call, bypassing the admin
app. Therefore it makes sense for the API to sanitise them.

The commit sanitises templates using a Mozilla’s Bleach library[1]. It is
configured to get the text content of the template, minus any HTML tags. It is
not using a regex because[2].

1. https://github.com/mozilla/bleach
2. http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags/1732454#1732454

app/template/rest.py

@@ -4,6 +4,7 @@ from flask import (
     request,
     current_app
 )
+import bleach
 from sqlalchemy.exc import IntegrityError
 
 from app.dao.templates_dao import (
@@ -34,6 +35,7 @@ def create_template(service_id):
     if errors:
         return jsonify(result="error", message=errors), 400
     new_template.service = fetched_service
+    new_template.content = _strip_html(new_template.content)
     try:
         dao_create_template(new_template)
     except IntegrityError as ex:
@@ -55,6 +57,7 @@ def update_template(service_id, template_id):
 
     current_data = dict(template_schema.dump(fetched_template).data.items())
     current_data.update(request.get_json())
+    current_data['content'] = _strip_html(current_data['content'])
 
     update_dict, errors = template_schema.load(current_data)
     if errors:
@@ -79,3 +82,7 @@ def get_template_by_id_and_service_id(service_id, template_id):
         return jsonify(data=data)
     else:
         return jsonify(result="error", message="Template not found"), 404
+
+
+def _strip_html(content):
+    return bleach.clean(content, tags=[], strip=True)