Security: fix CSS injection, javascript: URL injection, and SVG script injection#36

Draft

Copilot wants to merge 3 commits intomainfrom

copilot/exploit-repo-and-implement-defenses

Commits on Apr 7, 2026

Initial plan
Copilot
authored
security: fix CSS injection, javascript: URL injection, and SVG script injection

Copilot
and
zaxlofful
authored
security: make style closing-tag regex consistent with script pattern

Copilot
and
zaxlofful
authored