fix(docworker): Fix sanitizing Markdown and HTML

[MarekSuchanek]

No description provided.

[Copilot]

Pull request overview

This PR hardens the document worker against unsafe HTML/Markdown content and unsafe resource fetching during rendering by introducing explicit sanitization and a URL security policy applied to both WeasyPrint resource loading and Jinja-initiated HTTP requests.

Changes:

• Add HTML sanitization via nh3 and make Markdown rendering sanitize by default (opt-out for template-controlled content).
• Introduce a security configuration section and a shared UrlPolicy used to restrict file: access, private/loopback/link-local targets, and redirect behavior.
• Add unit tests and update end-user documentation describing the new security behavior.

Reviewed changes

Copilot reviewed 19 out of 20 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
uv.lock	Adds nh3 and a test extra (pytest) to the locked dependency set.
pyproject.toml	Updates Ruff Bandit configuration to allow safe Markup(...) usage for sanitizer output.
packages/dsw-document-worker/pyproject.toml	Adds nh3 as a runtime dependency and introduces a test optional dependency with pytest.
packages/dsw-document-worker/Makefile	Replaces the “no tests” target with an actual pytest invocation.
packages/dsw-document-worker/dsw/document_worker/sanitizer.py	New strict allow-list HTML sanitizer built on nh3.
packages/dsw-document-worker/dsw/document_worker/model/utils.py	Makes render_markdown(..., sanitize=True) sanitize by default and adds opt-out.
packages/dsw-document-worker/dsw/document_worker/urls.py	Adds UrlPolicy and URL validation utilities for HTTP/file/data URL handling.
packages/dsw-document-worker/dsw/document_worker/model/http.py	Wraps template HTTP requests with URL policy checks, redirect handling, and credential dropping.
packages/dsw-document-worker/dsw/document_worker/templates/steps/template.py	Wires UrlPolicy into the template-exposed requests wrapper.
packages/dsw-document-worker/dsw/document_worker/templates/steps/conversion.py	Adds a restricted WeasyPrint URL fetcher enforcing UrlPolicy.
packages/dsw-document-worker/dsw/document_worker/config.py	Adds security config keys + SecurityConfig model and includes it in the app config.
packages/dsw-document-worker/config.example.yml	Documents the new security configuration section.
packages/dsw-document-worker/support/steps/weasyprint.md	Documents restricted resource fetching behavior during PDF generation.
packages/dsw-document-worker/support/steps/jinja.md	Documents security restrictions applied to template HTTP requests.
packages/dsw-document-worker/support/JinjaFilters.md	Documents the Markdown filter’s default sanitization and opt-out.
packages/dsw-document-worker/tests/test_sanitizer.py	Adds sanitizer + Markdown rendering security tests.
packages/dsw-document-worker/tests/test_urls.py	Adds URL policy tests (private ranges, schemes, file constraints).
packages/dsw-document-worker/tests/test_http.py	Adds tests for the template HTTP wrapper (blocked URLs, redirect rules, forbidden kwargs).
packages/dsw-document-worker/CHANGELOG.md	Notes new security config and changed Markdown sanitization default.
.cspell/dictionary.txt	Adds a term used in networking code (IPPROTO).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.