+1, but it might be better to nuke the no_js method entirely and ensure that this is done globally -- anywhere that markdown is rendered. I'm worried about someone forgetting to call no_js and leaving open an XSS attack vector. I think this should be handled automatically.

The markdown filter calls the no_js() method, so everywhere we put markdown it will run bleach, but keeping the no_js filter also allows to have other places where we can strip down potential JS (doc or README for example).

But I'm seeing some issue with the bleach library, need to check out more carefully how to use it.

Ok with the latest commit at least pagure's README displays about correctly

Jenkins told me there were still some problems but this last commit should resolve them.
Let see what it says but otherwise, second review welcome :)

Still looks good to me. :earth_africa: 頑張って