prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Bump pybluemonday to latest
  Just tracking this so we don't forget. Latest should be 0.0.6 with bluemonday at 1.0.10. It adds support for comments in the HTML output. 
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `CTFd/utils/security/sanitize.py`
  Content:
  ```
  1 from pybluemonday import UGCPolicy
  2 
  3 # Copied from lxml:
  4 # https://github.com/lxml/lxml/blob/e986a9cb5d54827c59aefa8803bc90954d67221e/src/lxml/html/defs.py#L38
  5 # fmt: off
  6 SAFE_ATTRS = (
  7     'abbr', 'accept', 'accept-charset', 'accesskey', 'action', 'align',
  8     'alt', 'axis', 'border', 'cellpadding', 'cellspacing', 'char', 'charoff',
  9     'charset', 'checked', 'cite', 'class', 'clear', 'cols', 'colspan',
  10     'color', 'compact', 'coords', 'datetime', 'dir', 'disabled', 'enctype',
  11     'for', 'frame', 'headers', 'height', 'href', 'hreflang', 'hspace', 'id',
  12     'ismap', 'label', 'lang', 'longdesc', 'maxlength', 'media', 'method',
  13     'multiple', 'name', 'nohref', 'noshade', 'nowrap', 'prompt', 'readonly',
  14     'rel', 'rev', 'rows', 'rowspan', 'rules', 'scope', 'selected', 'shape',
  15     'size', 'span', 'src', 'start', 'summary', 'tabindex', 'target', 'title',
  16     'type', 'usemap', 'valign', 'value', 'vspace', 'width'
  17 )
  18 # fmt: on
  19 
  20 PAGE_STRUCTURE_TAGS = {
  21     "title": [],
  22 }
  23 
  24 META_TAGS = {
  25     "meta": ["name", "content", "property"],
  26 }
  27 
  28 FORM_TAGS = {
  29     "form": ["method", "action"],
  30     "button": ["name", "type", "value", "disabled"],
  31     "input": ["name", "type", "value", "placeholder"],
  32     "select": ["name", "value", "placeholder"],
  33     "option": ["value"],
  34     "textarea": ["name", "value", "placeholder"],
  35     "label": ["for"],
  36 }
  37 
  38 ANNOYING_TAGS = {
  39     "blink": [],
  40     "marquee": [],
  41 }
  42 
  43 
  44 MEDIA_TAGS = {
  45     "audio": ["autoplay", "controls", "crossorigin", "loop", "muted", "preload", "src"],
  46     "video": [
  47         "autoplay",
  48         "buffered",
  49         "controls",
  50         "crossorigin",
  51         "loop",
  52         "muted",
  53         "playsinline",
  54         "poster",
  55         "preload",
  56         "src",
  57     ],
  58     "source": ["src", "type"],
  59     "iframe": ["width", "height", "src", "frameborder", "allow", "allowfullscreen"],
  60 }
  61 
  62 SANITIZER = UGCPolicy()
  63 
  64 for TAGS in (PAGE_STRUCTURE_TAGS, META_TAGS, FORM_TAGS, ANNOYING_TAGS, MEDIA_TAGS):
  65     for element in TAGS:
  66         SANITIZER.AllowElements(element)
  67         SANITIZER.AllowAttrs(*TAGS[element]).OnElements(element)
  68 
  69 # Allow safe attrs copied from lxml
  70 SANITIZER.AllowAttrs(*SAFE_ATTRS).Globally()
  71 
  72 # Allow styling globally
  73 SANITIZER.AllowAttrs("class", "style").Globally()
  74 
  75 # Allow styling via bluemonday
  76 SANITIZER.AllowStyling()
  77 
  78 # Allow safe convenience functions from bluemonday
  79 SANITIZER.AllowStandardAttributes()
  80 SANITIZER.AllowStandardURLs()
  81 
  82 # Allow data atributes
  83 SANITIZER.AllowDataAttributes()
  84 
  85 # Allow data URI images
  86 SANITIZER.AllowDataURIImages()
  87 
  88 # Link security
  89 SANITIZER.AllowRelativeURLs(True)
  90 SANITIZER.RequireNoFollowOnFullyQualifiedLinks(True)
  91 SANITIZER.RequireNoFollowOnLinks(True)
  92 SANITIZER.RequireNoReferrerOnFullyQualifiedLinks(True)
  93 SANITIZER.RequireNoReferrerOnLinks(True)
  94 
  95 
  96 def sanitize_html(html):
  97     return SANITIZER.sanitize(html)
  98
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/CTFd/utils/security/sanitize.py b/CTFd/utils/security/sanitize.py
  --- a/CTFd/utils/security/sanitize.py
  +++ b/CTFd/utils/security/sanitize.py
  @@ -92,6 +92,9 @@
   SANITIZER.RequireNoReferrerOnFullyQualifiedLinks(True)
   SANITIZER.RequireNoReferrerOnLinks(True)
   
  +# Allow Comments
  +SANITIZER.AllowComments()
  +
   
   def sanitize_html(html):
       return SANITIZER.sanitize(html)
  
verification_info: {"golden_diff": "diff --git a/CTFd/utils/security/sanitize.py b/CTFd/utils/security/sanitize.py\n--- a/CTFd/utils/security/sanitize.py\n+++ b/CTFd/utils/security/sanitize.py\n@@ -92,6 +92,9 @@\n SANITIZER.RequireNoReferrerOnFullyQualifiedLinks(True)\n SANITIZER.RequireNoReferrerOnLinks(True)\n \n+# Allow Comments\n+SANITIZER.AllowComments()\n+\n \n def sanitize_html(html):\n     return SANITIZER.sanitize(html)\n", "issue": "Bump pybluemonday to latest\nJust tracking this so we don't forget. Latest should be 0.0.6 with bluemonday at 1.0.10. It adds support for comments in the HTML output. \n", "before_files": [{"content": "from pybluemonday import UGCPolicy\n\n# Copied from lxml:\n# https://github.com/lxml/lxml/blob/e986a9cb5d54827c59aefa8803bc90954d67221e/src/lxml/html/defs.py#L38\n# fmt: off\nSAFE_ATTRS = (\n    'abbr', 'accept', 'accept-charset', 'accesskey', 'action', 'align',\n    'alt', 'axis', 'border', 'cellpadding', 'cellspacing', 'char', 'charoff',\n    'charset', 'checked', 'cite', 'class', 'clear', 'cols', 'colspan',\n    'color', 'compact', 'coords', 'datetime', 'dir', 'disabled', 'enctype',\n    'for', 'frame', 'headers', 'height', 'href', 'hreflang', 'hspace', 'id',\n    'ismap', 'label', 'lang', 'longdesc', 'maxlength', 'media', 'method',\n    'multiple', 'name', 'nohref', 'noshade', 'nowrap', 'prompt', 'readonly',\n    'rel', 'rev', 'rows', 'rowspan', 'rules', 'scope', 'selected', 'shape',\n    'size', 'span', 'src', 'start', 'summary', 'tabindex', 'target', 'title',\n    'type', 'usemap', 'valign', 'value', 'vspace', 'width'\n)\n# fmt: on\n\nPAGE_STRUCTURE_TAGS = {\n    \"title\": [],\n}\n\nMETA_TAGS = {\n    \"meta\": [\"name\", \"content\", \"property\"],\n}\n\nFORM_TAGS = {\n    \"form\": [\"method\", \"action\"],\n    \"button\": [\"name\", \"type\", \"value\", \"disabled\"],\n    \"input\": [\"name\", \"type\", \"value\", \"placeholder\"],\n    \"select\": [\"name\", \"value\", \"placeholder\"],\n    \"option\": [\"value\"],\n    \"textarea\": [\"name\", \"value\", \"placeholder\"],\n    \"label\": [\"for\"],\n}\n\nANNOYING_TAGS = {\n    \"blink\": [],\n    \"marquee\": [],\n}\n\n\nMEDIA_TAGS = {\n    \"audio\": [\"autoplay\", \"controls\", \"crossorigin\", \"loop\", \"muted\", \"preload\", \"src\"],\n    \"video\": [\n        \"autoplay\",\n        \"buffered\",\n        \"controls\",\n        \"crossorigin\",\n        \"loop\",\n        \"muted\",\n        \"playsinline\",\n        \"poster\",\n        \"preload\",\n        \"src\",\n    ],\n    \"source\": [\"src\", \"type\"],\n    \"iframe\": [\"width\", \"height\", \"src\", \"frameborder\", \"allow\", \"allowfullscreen\"],\n}\n\nSANITIZER = UGCPolicy()\n\nfor TAGS in (PAGE_STRUCTURE_TAGS, META_TAGS, FORM_TAGS, ANNOYING_TAGS, MEDIA_TAGS):\n    for element in TAGS:\n        SANITIZER.AllowElements(element)\n        SANITIZER.AllowAttrs(*TAGS[element]).OnElements(element)\n\n# Allow safe attrs copied from lxml\nSANITIZER.AllowAttrs(*SAFE_ATTRS).Globally()\n\n# Allow styling globally\nSANITIZER.AllowAttrs(\"class\", \"style\").Globally()\n\n# Allow styling via bluemonday\nSANITIZER.AllowStyling()\n\n# Allow safe convenience functions from bluemonday\nSANITIZER.AllowStandardAttributes()\nSANITIZER.AllowStandardURLs()\n\n# Allow data atributes\nSANITIZER.AllowDataAttributes()\n\n# Allow data URI images\nSANITIZER.AllowDataURIImages()\n\n# Link security\nSANITIZER.AllowRelativeURLs(True)\nSANITIZER.RequireNoFollowOnFullyQualifiedLinks(True)\nSANITIZER.RequireNoFollowOnLinks(True)\nSANITIZER.RequireNoReferrerOnFullyQualifiedLinks(True)\nSANITIZER.RequireNoReferrerOnLinks(True)\n\n\ndef sanitize_html(html):\n    return SANITIZER.sanitize(html)\n", "path": "CTFd/utils/security/sanitize.py"}], "after_files": [{"content": "from pybluemonday import UGCPolicy\n\n# Copied from lxml:\n# https://github.com/lxml/lxml/blob/e986a9cb5d54827c59aefa8803bc90954d67221e/src/lxml/html/defs.py#L38\n# fmt: off\nSAFE_ATTRS = (\n    'abbr', 'accept', 'accept-charset', 'accesskey', 'action', 'align',\n    'alt', 'axis', 'border', 'cellpadding', 'cellspacing', 'char', 'charoff',\n    'charset', 'checked', 'cite', 'class', 'clear', 'cols', 'colspan',\n    'color', 'compact', 'coords', 'datetime', 'dir', 'disabled', 'enctype',\n    'for', 'frame', 'headers', 'height', 'href', 'hreflang', 'hspace', 'id',\n    'ismap', 'label', 'lang', 'longdesc', 'maxlength', 'media', 'method',\n    'multiple', 'name', 'nohref', 'noshade', 'nowrap', 'prompt', 'readonly',\n    'rel', 'rev', 'rows', 'rowspan', 'rules', 'scope', 'selected', 'shape',\n    'size', 'span', 'src', 'start', 'summary', 'tabindex', 'target', 'title',\n    'type', 'usemap', 'valign', 'value', 'vspace', 'width'\n)\n# fmt: on\n\nPAGE_STRUCTURE_TAGS = {\n    \"title\": [],\n}\n\nMETA_TAGS = {\n    \"meta\": [\"name\", \"content\", \"property\"],\n}\n\nFORM_TAGS = {\n    \"form\": [\"method\", \"action\"],\n    \"button\": [\"name\", \"type\", \"value\", \"disabled\"],\n    \"input\": [\"name\", \"type\", \"value\", \"placeholder\"],\n    \"select\": [\"name\", \"value\", \"placeholder\"],\n    \"option\": [\"value\"],\n    \"textarea\": [\"name\", \"value\", \"placeholder\"],\n    \"label\": [\"for\"],\n}\n\nANNOYING_TAGS = {\n    \"blink\": [],\n    \"marquee\": [],\n}\n\n\nMEDIA_TAGS = {\n    \"audio\": [\"autoplay\", \"controls\", \"crossorigin\", \"loop\", \"muted\", \"preload\", \"src\"],\n    \"video\": [\n        \"autoplay\",\n        \"buffered\",\n        \"controls\",\n        \"crossorigin\",\n        \"loop\",\n        \"muted\",\n        \"playsinline\",\n        \"poster\",\n        \"preload\",\n        \"src\",\n    ],\n    \"source\": [\"src\", \"type\"],\n    \"iframe\": [\"width\", \"height\", \"src\", \"frameborder\", \"allow\", \"allowfullscreen\"],\n}\n\nSANITIZER = UGCPolicy()\n\nfor TAGS in (PAGE_STRUCTURE_TAGS, META_TAGS, FORM_TAGS, ANNOYING_TAGS, MEDIA_TAGS):\n    for element in TAGS:\n        SANITIZER.AllowElements(element)\n        SANITIZER.AllowAttrs(*TAGS[element]).OnElements(element)\n\n# Allow safe attrs copied from lxml\nSANITIZER.AllowAttrs(*SAFE_ATTRS).Globally()\n\n# Allow styling globally\nSANITIZER.AllowAttrs(\"class\", \"style\").Globally()\n\n# Allow styling via bluemonday\nSANITIZER.AllowStyling()\n\n# Allow safe convenience functions from bluemonday\nSANITIZER.AllowStandardAttributes()\nSANITIZER.AllowStandardURLs()\n\n# Allow data atributes\nSANITIZER.AllowDataAttributes()\n\n# Allow data URI images\nSANITIZER.AllowDataURIImages()\n\n# Link security\nSANITIZER.AllowRelativeURLs(True)\nSANITIZER.RequireNoFollowOnFullyQualifiedLinks(True)\nSANITIZER.RequireNoFollowOnLinks(True)\nSANITIZER.RequireNoReferrerOnFullyQualifiedLinks(True)\nSANITIZER.RequireNoReferrerOnLinks(True)\n\n# Allow Comments\nSANITIZER.AllowComments()\n\n\ndef sanitize_html(html):\n    return SANITIZER.sanitize(html)\n", "path": "CTFd/utils/security/sanitize.py"}]}