sanitizeHtml (lib/sanitize.ts)

TypeScript function to sanitize HTML content using DOMPurify with a strict allowlist.

// Source: https://github.com/daggerhashimoto/openclaw-nerve | License: MIT | Copyright 2025-2026 Nerve contributors
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * sanitize.ts - XSS prevention via DOMPurify
 * 
 * SECURITY NOTES:
 * - All user-generated or streamed HTML MUST pass through sanitizeHtml()
 * - The config uses an allowlist approach: only explicitly listed tags/attrs are kept
 * - href attributes are sanitized by DOMPurify to block javascript: and data: URIs
 * - SVG and other potentially dangerous tags are NOT in the allowlist (blocked by default)
 * 
 * The allowlist is minimal and focused on markdown rendering needs.
 * When in doubt, don't add a tag - the markdown renderer uses esc() first,
 * so most content is already escaped before reaching DOMPu

... (truncated -- full source via MCP)