Since bleach.ALLOWED_ATTRIBUTES is a mutable dictionary, this modifies bleach.ALLOWED_ATTRIBUTES itself, so anyone who is using this will have tables that allow the class attribute.

This may well be fine and the desired global behaviour, but it's a very surprising side-effect of calling this function. I'd recommend either making a deep copy of bleach.ALLOWED_ATTRIBUTES and working with that here, or defining a constant that does the same in a common module and have everyone import from there if this is globally desired.

Well, bleach is only used here in the entire project and another process using bleach will not be impacted by these changes.

Quite true. My only concern is at some point later bleach will get used elsewhere in Pagure and the constant is, well... Not constant.

:thumbsup: Looks good

Cool, thanks and thanks for pointing it out :)