DOMPurify + Trusted Types in admin/editor

[tayebmokni]

Summary

Wire DOMPurify into the admin editor with the configuration from doc 13 §4.3 and integrate Trusted Types so innerHTML sinks only accept TrustedHTML values. Editor surfaces that accept paste/HTML-import call sanitizePasted(html) which returns a TrustedHTML via RETURN_TRUSTED_TYPE: true. The admin CSP (issue #59) enforces require-trusted-types-for 'script' so any unsanitized assignment fails closed.

Design reference

• docs/13-security-baseline.md §4.3 (DOMPurify in the editor)

Acceptance criteria

• frontend/admin/sanitize.ts exports sanitizePasted(html: string): TrustedHTML
• DOMPurify configured with USE_PROFILES: { html: true }, FORBID_TAGS (style, form, input, iframe, frame, object, embed), FORBID_ATTR (onerror, onload, onclick, onmouseover, onfocus, onblur), ALLOW_DATA_ATTR: false, RETURN_TRUSTED_TYPE: true
• Block editor paste handler calls sanitizePasted before insertion
• All innerHTML writes in admin use the TrustedHTML value
• Negative tests: assigning a plain string to innerHTML in admin fails the Trusted Types check in test browser
• Lint rule flags raw innerHTML = assignments without sanitizer

Dependencies

#59

Complexity

M

[tayebmokni]

Closing — shipped in #469 (DOMPurify + Trusted Types). Auto-close fired for #59 only.