fix(frontend): render raw HTML in package READMEs (sanitized)

[ggreif]

Problem

Package README pages show raw HTML tags as literal visible text. For example, mops.one/googlemail-client@0.1.3 renders a <details>/<summary> collapsible block as the plain strings <details> and <summary> rather than a working disclosure widget. GitHub renders the same README correctly.

Root cause

frontend/logic/markdown-to-html.ts configures markdown-it with html: false, which escapes all raw HTML in README source. The inline comment even read // Enable HTML tags in source — the opposite of what false does. GitHub, by contrast, permits a sanitized allowlist of tags (including <details>/<summary>), which is why authors write them.

Fix

Enable html: true and sanitize the rendered output with DOMPurify — the standard, GitHub-equivalent approach:

• Allows a safe tag allowlist (incl. <details>/<summary>, and keeps class so starry-night syntax highlighting is preserved).
• Strips <script>, inline event handlers, and javascript: URLs — so enabling raw HTML does not open an XSS hole, which matters since READMEs are arbitrary third-party author content.

Two incidental cleanups in the same file:

• Corrected the misleading comment to match behavior.
• Removed a dead duplicate mdit.render(markdown) call whose result was discarded (the source was parsed twice per render).

Impact / retroactivity

README → HTML conversion happens client-side at view time (PackageReadme.svelte calls markdownToHtml(readme, …) on each render), from the stored Markdown source. So this fix repairs every already-published package page on the next load — no republish, version bump, or re-upload required.

Validation

• svelte-check --threshold error → 0 errors (pre-existing warnings unchanged).
• DOMPurify v3 ships its own types; pinned exact (3.4.11) to match the repo's dependency convention. Lockfile gains only the single dependency.

🤖 Generated with Claude Code

[github-actions]

Cursor AI review

👍 APPROVE — looks safe to merge

Category	Assessment	Details
Summary	✅	Enables raw HTML in package README/release-note markdown via html: true, sanitizes with DOMPurify (allowlist incl. <details>/<summary>), removes a dead duplicate render, and adds DOMPurify to AsciiDoc docs output.
Code Quality	✅	Standard fix pattern; removes wasted double mdit.render(); focused dependency add.
Consistency	✅	Aligns with GitHub-style README rendering; {@html} paths now consistently sanitized.
Security	✅	Net improvement over base (escaped HTML / unsanitized AsciiDoc); allowlist + DOMPurify URI handling addresses third-party README XSS.
Tests	✅	No new tests, but this path had none at base; change is straightforward sanitization wiring.
Maintainability	✅	Clear comments; pinned dompurify@3.4.11; small, reviewable diff across 4 files.

Verdict

Decision: APPROVE
Risk: Low
Reason: The change correctly fixes escaped raw HTML in READMEs with a standard markdown-it + DOMPurify allowlist approach, and the incidental PackageDocs sanitization hardens an existing {@html} path without regressions. No correctness or security defects identified relative to base.

---

Generated for commit 9efd2d5

[Kamirus]

Added a follow-up commit: sanitize Asciidoctor output in PackageDocs to prevent XSS.

• PackageDocs.svelte:140 — wraps doc.convert() with DOMPurify.sanitize() to block script/event-handler injection from AsciiDoc docs.
• Adds @types/dompurify as a dev dependency.

Also added another commit: restrict DOMPurify allowlist to safe Markdown output tags — the bare DOMPurify.sanitize() call in markdown-to-html.ts used DOMPurify's broad defaults which allow <form>, <input>, <button>, and <style>. Switched to an explicit ALLOWED_TAGS/ALLOWED_ATTR allowlist scoped to Markdown output elements (matching GitHub's sanitizer posture).