Pull request overview

This PR adjusts the nominations “statement” rendering pipeline and preview styling so markdown constructs (notably lists and blockquotes) render correctly on election nomination pages while still preventing raw HTML from being interpreted.

Changes:

• Swap the nomination statement’s markdown renderer to a custom “HTML-neutralizing” markdown path via markup_choices.
• Add CSS in the nomination form preview area to undo site-wide list styling so rendered markdown lists display as actual lists.
• Add model-level tests to validate blockquotes/lists/headings render while raw HTML is neutralized.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

apps/nominations/tests/test_models.py:77

• This docstring says the statement pipeline must “never” allow raw HTML, but with escape_html disabled the markdown renderer can pass through raw HTML that is then sanitized (some tags like //

  are allowlisted). Adjust the docstring to reflect the actual contract: markdown is allowed and the resulting HTML is sanitized.

class NominationStatementRenderingTests(TestCase):
    """The statement pipeline must allow markdown but never raw HTML."""

    # No escape_html: it escapes `>` too and breaks blockquotes. pydotorg.markup
    # sanitizes every renderer's output, so raw HTML is dropped there instead.
    nomination_statement = MarkupField(markup_type="markdown", blank=False, null=True)

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

apps/nominations/models.py:265

• nomination_statement previously forced escape_html=True but now relies on MarkupField's default. Since this change is security- and rendering-sensitive (it affects whether characters like > are preserved and how raw HTML is handled), it’s safer to make the intended behavior explicit in the field declaration rather than depending on a third-party default.

    employer = models.CharField(max_length=1024, blank=False, null=True)  # noqa: DJ001
    other_affiliations = models.CharField(max_length=2048, blank=True, null=True)  # noqa: DJ001
    nomination_statement = MarkupField(markup_type="markdown", blank=False, null=True)

apps/nominations/tests/test_models.py:77

• The docstring says the statement pipeline must allow markdown but “never raw HTML”, but the site-wide MarkupField renderers sanitize HTML (via nh3.clean) and can still allow some HTML tags/attributes. Consider rewording this to reflect that the pipeline sanitizes HTML rather than implying all raw HTML is rejected.

class NominationStatementRenderingTests(TestCase):
    """The statement pipeline must allow markdown but never raw HTML."""