Keep the formatting the content needs
Course material uses tables, lists and headings. Removing every tag would remove useful structure as well as unsafe markup, so the shared sanitizer works from explicit rules for allowed tags, attributes and styles.
It removes event handlers, checks link and image URL schemes, restricts CSS and adds noopener and noreferrer to links that open a new window. When parsing fails or the DOM parser isn't available, it returns escaped text. Tests check both sides: supported formatting should remain, while scripts, embeds and unsupported attributes or styles should not.
Stored content can bypass the current editor
The hardening review found announcement and newsletter views rendering saved bodies directly. An older or imported record could reach the player, editor preview or email without ever passing through the current save-time sanitizer.
The repair added the shared sanitizer to those output paths and the newsletter preheader source. Regression fixtures deliberately place malicious HTML straight into storage, then check that useful text remains while script markers, event handlers and scriptable URLs disappear.
The May report records passing content and sanitizer checks, with environment warnings in the feature run. Those results cover the identified paths and fixtures; they aren't a browser check of every possible HTML payload.