HTML sanitization for rich-text content

[seanmalbert]

• General
• Backend
• Public
• Partners

Background / Issue

JurisdictionContent rich-text bodies are admin-authored HTML, so stored HTML must be sanitized to
prevent stored XSS. This is a precondition for enabling the structured-content editor for any
jurisdiction.

Technical Context

• TDD: §3.2, Open Question 3.
• Resolve OQ3 (sanitizer library and tag/attribute allowlist). Apply sanitization on write and as a
  defense-in-depth pass on render.
• Depends on: none. Prerequisite for the structured-content editor (Partners structured-content editor #6517) go-live; also used by the
  JurisdictionContent write path (JurisdictionContent service and admin CRUD #6511) and the seed migration's markdown conversion (Seed / data migration command #6519).

Acceptance Criteria

• A documented tag/attribute allowlist is enforced on write; a payload with disallowed tags/attrs
  (including javascript: link targets) is stripped or rejected.
• Render passes stored HTML through the sanitizer as a defense-in-depth step.
• The sanitizer is in place before enableDbDrivenContent is flipped on for any jurisdiction.

QA Notes

Backend/shared. Test known XSS vectors (script tags, on* handlers, javascript: hrefs, disallowed
tags) are removed on write and render; confirm allowed formatting survives.