bd15a339842d695b56b0ddf7bba29a1a0738473b
Closes XSS hole in HtmlBlock by sanitizing user/AI-supplied markup through DOMPurify before passing to dangerouslySetInnerHTML. Adds Vitest + jsdom for unit testing with 5 passing tests covering script stripping, on-event handler removal, javascript: URL blocking, iframe allowlist, and form/input stripping. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Languages
TypeScript
75.9%
JavaScript
12.3%
HTML
8.6%
CSS
2.6%
PHP
0.4%
Other
0.2%