fix(web): secure rich content rendering

web/default/src/components/html-content.tsx

@@ -16,6 +16,9 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 For commercial licensing, please contact support@quantumnous.com
 */
+import DOMPurify from 'dompurify'
+import { useMemo } from 'react'
+
 import { cn } from '@/lib/utils'
 
 interface HtmlContentProps {
@@ -24,10 +27,16 @@ interface HtmlContentProps {
 }
 
 export function HtmlContent(props: HtmlContentProps) {
+  const html = useMemo(() => DOMPurify.sanitize(props.content), [props.content])
+
   return (
     <div
-      className={cn('prose prose-neutral dark:prose-invert max-w-none', props.className)}
-      dangerouslySetInnerHTML={{ __html: props.content }}
+      className={cn(
+        'prose prose-neutral dark:prose-invert max-w-none',
+        props.className
+      )}
+      // eslint-disable-next-line react/no-danger -- html is sanitized above
+      dangerouslySetInnerHTML={{ __html: html }}
     />
   )
 }