Jakub Zych 528d2d8451 fix(classes): keep raw HTML in content_html behind the safety gate ...

- FormatHTML renders with goldmark html.WithUnsafe(), as Winter's
  Markdown::parse passes raw HTML through, so an admin save, an import or
  an API write no longer turns imported HTML into raw HTML omitted
- rejectUnsafe still runs after the render and refuses script, iframe,
  object and embed tags, event handlers and javascript, vbscript and data
  URLs; API response shapes are unchanged
- TestFormatHTMLKeepsRawHTML covers HTML paragraphs and a raw footer

2026-10-09 20:58:49 +02:00

2.2 KiB

Raw Blame History

View Raw