I'd really prefer a call to bleach or jinja escaping rather than manual html escaping.

I would prefer if we consolidate on one solution (bleach) to escape the html, it will make it easier to have a consistent behaviour and make it easier to debug when an unexpected behaviour is reported.

I would prefer if we consolidate on one solution (bleach) to escape the html, it will make it easier to have a consistent behaviour and make it easier to debug when an unexpected behaviour is reported.

I think bleach is not to escape HTML. Escaping HTML only means to replace some special characters. Bleach is used to filter out some attr of a HTML tag(in pagure case).

The problem here is not about when to escape HTML or how to escape HTML. Problem here is we generate a invalid pre tag. Inside pre tag there should not be any tag, thus I use jinja to escape HTML special characters and make the pre tag valid

think bleach is not to escape HTML.

Well it does some escaping: https://github.com/mozilla/bleach#basic-use

While trying to replicate #1831 I realized it isn't related to the escaping but to bleach actually:

>>> import bleach, jinja2
>>> bleach.clean('`<https://www.gnu.org="" licenses="" agpl-3.0.html="">`_')
u'`&lt;https: www.gnu.org="" licenses="" agpl-3.0.html=""&gt;`_'

However, escaping the html before giving to bleach solves the problem:

>>> bleach.clean(jinja2.escape('`<https://www.gnu.org="" licenses="" agpl-3.0.ht
ml="">`_'))
u'`&lt;https://www.gnu.org="" licenses="" agpl-3.0.html=""&gt;`_'

So I think this looks good, thanks for this!