setup.py

@@ -178,7 +178,7 @@ setup(
         'Quixote>=3.0,<3.2',
         'django>=3.2',
         'psycopg2',
-        'bleach<5',
+        'bleach',
         'dnspython',
         'gadjo>=0.53',
         'django-ckeditor<4.5.4',

tox.ini

@@ -32,6 +32,7 @@ deps =
     pylint
     pre-commit
     pyzbar
+    bleach<5
 # others...
     django32: django>=3.2,<3.3
 allowlist_externals =

wcs/qommon/form.py

@@ -2615,13 +2615,25 @@ class WysiwygTextWidget(TextWidget):
                 all_tags.append('style')
             if get_publisher().get_site_option('ckeditor-allow-script-tag'):
                 all_tags.append('script')
+
+            try:
+                from bleach.css_sanitizer import CSSSanitizer
+
+                css_sanitizer = CSSSanitizer(allowed_css_properties=self.ALL_STYLES)
+                kwargs = {
+                    'css_sanitizer': css_sanitizer,
+                }
+            except ModuleNotFoundError:
+                # bleach < 5
+                kwargs = {'styles': self.ALL_STYLES}
+
             cleaner = Cleaner(
                 tags=all_tags,
                 attributes=self.ALL_ATTRS,
-                styles=self.ALL_STYLES,
                 strip=True,
                 strip_comments=False,
                 filters=[partial(LinkifyFilter, skip_tags=['pre'], parse_email=True)],
+                **kwargs,
             )
             self.value = cleaner.clean(self.value)
             if self.value.startswith('<br />'):