chore: move from sanitize-html to js-xss

[chohner]

I realized that our dependency to sanitize rendered markdown causes a huge chunk of runtime warnings:

This is due to a transitive postcss dependency, see this issue.

There are two options:

• use an isomorphic library (this PR)
• render & sanatize markdown on server (preferred but larger architectural change)

Impact:

• tests pass & visual inspection looks good ✅
• 14% reduction in gzipped bundle size:
  441.4 kB -> 381.12 kB

[aaschlote]

Can you please add tests for the h elements? It was added to be allowed recently but we don't have tests. And also a specific tests for removed some html tag element, like code? We don't have tests for that.

Besides that, the changes looks fine!

[chohner]

Can you please add tests for the h elements? It was added to be allowed recently but we don't have tests. And also a specific tests for removed some html tag element, like code? We don't have tests for that.

Besides that, the changes looks fine!

Good idea - I might do this before & outside of this PR

[pgurusinga]

nice one, it seems the new package is trustworthy https://socket.dev/npm/package/xss, can we add ADR for this? 🎉

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[aaschlote]

LGTM