Tighten HtmlSanitizer policy #23
Description
Problem
Current HtmlSanitizer configuration may allow XSS via unsafe tags/attributes/CSS.
Proposal
- Define and configure an explicit allowlist for tags, attributes, and CSS.
- Strip inline event handlers/scripts.
- Centralize and make configurable the policy, with unit tests for common XSS payloads.
Alternatives considered
- Use default HtmlSanitizer policy.
Acceptance criteria
- Inline event handlers/scripts stripped
- Unit tests cover common XSS payloads
- Policy centralized and configurable
Technical notes
- Configure HtmlSanitizer in DI and reuse everywhere
- Allow safe embeds as needed (e.g., a, p, img with src/alt)
Risks
- Overzealous policy may break legitimate content embeds.
Additional context
Labels: security, backend, test