feat(admin): edit category content in the admin form behind the HTML gate

- add a content textarea (size huge) after description, with en and pl phrases
- add content to Category.Fillable
- export classes.CheckHTML and run it from FormBeforeCreate and FormBeforeUpdate:
  unsafe category content answers 422 on content, blank content is stored as NULL

classes/check_html_test.go

@@ -0,0 +1,34 @@
+package classes
+
+import "testing"
+
+func TestCheckHTML(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		ok   bool
+	}{
+		{"empty", "", true},
+		{"heading and link", `<h2>Cordyceps</h2><p>Plain <a href="https://example.test/a">link</a></p>`, true},
+		{"table", `<table><thead><tr><th>A</th></tr></thead><tbody><tr><td>1</td></tr></tbody></table>`, true},
+		{"script", `<script>alert(1)</script>`, false},
+		{"iframe", `<iframe src="https://example.test/"></iframe>`, false},
+		{"object", `<object data=x>`, false},
+		{"embed", `<embed src=x>`, false},
+		{"event handler", `<img src=x onerror="alert(1)">`, false},
+		{"javascript url", `<a href="javascript:alert(1)">`, false},
+		{"vbscript url mixed case", `<a href="VBScript:x">`, false},
+		{"data url", `<img src="data:image/png;base64,AAAA">`, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := CheckHTML(tc.in)
+			if tc.ok && err != nil {
+				t.Fatalf("CheckHTML(%q) = %v, want nil", tc.in, err)
+			}
+			if !tc.ok && err == nil {
+				t.Fatalf("CheckHTML(%q) = nil, want an error", tc.in)
+			}
+		})
+	}
+}

classes/format_html.go

@@ -37,6 +37,13 @@ func FormatHTML(src string) (string, error) {
 	return html, nil
 }
 
+// CheckHTML applies the FormatHTML safety gate to HTML that is stored as is,
+// such as category content. It refuses raw script, iframe, object and embed
+// tags, event handler attributes and javascript, vbscript or data URL schemes.
+func CheckHTML(html string) error {
+	return rejectUnsafe(html)
+}
+
 func rejectUnsafe(html string) error {
 	if markdownUnsafeTag.MatchString(html) {
 		return fmt.Errorf("journal: rendered HTML contains raw unsafe tags")