fix: add DomPurify to sanitize html

[aerodeval]

marked output was rendered without sanitization, letting javascript and event handlers execute in other users' browsers.

fix: Pass it through DOMPurify to successfully render md to HTML with any issues

Docs preview: https://ui.frappe.io/pr-preview/pr-819/

Coverage: 69.10% (-0.03% vs main)

[greptile-apps]

Confidence Score: 4/5

Safe to merge for browser-only use; introduces a silent empty-string failure path if the function is ever called outside a browser environment.

The change correctly adds XSS sanitization. The only concern is that DOMPurify will silently return empty string when there is no DOM, which current callers avoid but future ones may not.

src/utils/markdown.ts — specifically the DOMPurify import and its behavior in non-browser environments.

_{Reviews (1): Last reviewed commit: "fix: add DomPurify to sanitize html" | Re-trigger Greptile}

[greptile-apps]

DOMPurify silently returns empty string in SSR/Node.js — dompurify requires a browser DOM; without window/document it falls back to returning "", silently swallowing all markdown output. Current callers (paste extensions) are browser-only, but as a public utility this is a latent data-loss trap. Consider guarding with typeof window !== 'undefined' or using isomorphic-dompurify.

[barista-for-frappe]

Looks good — wraps markdownToHTML output in DOMPurify.sanitize to strip XSS from pasted markdown. Contained and safe.

• dompurify@^3.4.0 is already in dependencies, so no new install (package.json:175).
• No public API change. Both callers (content-paste-extension.ts:62, paste-markdown-utils.ts:18) are browser-only paste handlers, so DOMPurify's DOM requirement is fine.

Nit (optional): no test for the sanitization path — a one-liner asserting a <script> in markdown gets stripped would lock this in.