Remove form tag from allowed tags during sanitization (#11729)

src/OrchardCore/OrchardCore.Infrastructure/Html/OrchardCoreBuilderExtensions.cs

@@ -17,6 +17,7 @@ public static OrchardCoreBuilder AddHtmlSanitizer(this OrchardCoreBuilder builde
                 services.ConfigureHtmlSanitizer((sanitizer) =>
                 {
                     sanitizer.AllowedAttributes.Add("class");
+                    sanitizer.AllowedTags.Remove("form");
                 });
 
                 services.AddSingleton<IHtmlSanitizerService, HtmlSanitizerService>();

src/docs/reference/core/Sanitizer/README.md

@@ -18,13 +18,21 @@ It is used by default for the following parts and fields:
 
 `@Orchard.SanitizeHtml((string)Model.ContentItem.HtmlBodyPart.Html);`
 
+
+## Defaults configuration
+
+The elements sanitized by default are listed on this page: https://github.com/mganss/HtmlSanitizer#tags-allowed-by-default
+
+Orchard Core changes these defaults by:
+
+- allowing the attribute `class`
+- removing the tag `form`
+
 ## Configuring the Sanitizer
 
 The sanitizer is configurable using `IOptions<HtmlSanitizerOptions>` during service registration with a configuration 
 extension method `ConfigureHtmlSanitizer`.
 
-By default it allows css classes, but can be configured to accept other attributes.
-
 You may call this extension method multiple times during the startup pipeline to alter configurations.
 
 ```csharp