Rotimi Best
8d2f2a6d2d
The embed section passed code through SafeHtmlContent which ran DOMPurify with FORBID_TAGS including 'iframe', silently removing the element. Replaced SafeHtmlContent with a new sanitizeEmbedHtml() that uses a whitelist of ALLOWED_TAGS: ['iframe'] and restricts src to https: only, so Google Forms, YouTube, and other https embeds render while javascript: sources and non-iframe tags are still blocked.