Run nh3 cleaner over backend notes

src/backend/InvenTree/InvenTree/helpers.py

@@ -30,7 +30,7 @@ from stdimage.models import StdImageField, StdImageFieldFile
 
 from common.currency import currency_code_default
 from InvenTree.sanitizer import (
-    DEAFAULT_ATTRS,
+    DEFAULT_ATTRS,
     DEFAULT_CSS,
     DEFAULT_PROTOCOLS,
     DEFAULT_TAGS,
@@ -963,7 +963,7 @@ def clean_markdown(value: str) -> str:
 
     # nh3 sanitizer settings
     whitelist_tags = markdownify_settings.get('WHITELIST_TAGS', DEFAULT_TAGS)
-    whitelist_attrs = markdownify_settings.get('WHITELIST_ATTRS', DEAFAULT_ATTRS)
+    whitelist_attrs = markdownify_settings.get('WHITELIST_ATTRS', DEFAULT_ATTRS)
     whitelist_styles = markdownify_settings.get('WHITELIST_STYLES', DEFAULT_CSS)
     whitelist_protocols = markdownify_settings.get(
         'WHITELIST_PROTOCOLS', DEFAULT_PROTOCOLS

src/backend/InvenTree/InvenTree/sanitizer.py

@@ -244,7 +244,7 @@ ALLOWED_ATTRIBUTES_SVG = [
 ]
 
 # Default allowlists (matching bleach's original defaults)
-# TODO: I do not see us needing a bunch of these but I do not want to introduce a breaking change; we might want to narroy this down with the next breaking change
+# TODO: I do not see us needing a bunch of these but I do not want to introduce a breaking change; we might want to narrow this down with the next breaking change
 DEFAULT_TAGS = frozenset([
     'a',
     'abbr',
@@ -259,7 +259,7 @@ DEFAULT_TAGS = frozenset([
     'strong',
     'ul',
 ])
-DEAFAULT_ATTRS = {'a': {'href', 'title'}, 'abbr': {'title'}, 'acronym': {'title'}}
+DEFAULT_ATTRS = {'a': {'href', 'title'}, 'abbr': {'title'}, 'acronym': {'title'}}
 DEFAULT_CSS = frozenset([
     'azimuth',
     'background-color',

src/backend/InvenTree/common/models.py

@@ -42,6 +42,7 @@ from django.urls import reverse
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 
+import nh3
 import structlog
 from anymail.signals import inbound, tracking
 from django_q.signals import post_spawn
@@ -3045,6 +3046,8 @@ class Note(
         if not others.exists():
             self.primary = True
 
+        self.clean()
+
         super().save(*args, **kwargs)
 
         # Once this note is saved, mark other notes as non-primary
@@ -3060,7 +3063,9 @@ class Note(
 
     def clean(self):
         """Clean / validate the note before saving to the database."""
-        # TODO: Implement this
+        if self.content:
+            self.content = self.content.strip()
+            self.content = nh3.clean(self.content)
 
     def check_save(self):
         """Check if this note can be saved."""