Remote HTML is sanitized before it is stored

S5 of the roadmap. ContentSanitizer wraps HtmlSanitizer with Mastodon's
allowlist: the inline and list tags Mastodon keeps, href/rel/class and
the list attributes, microformat and mention/hashtag/ellipsis/invisible
classes, Mastodon's link schemes, every link rel=nofollow noopener
noreferrer, relative links unlinked, headings folded to a bold paragraph,
and the contents of script, style, svg, iframe and friends dropped rather
than kept as text.

Post and DmPost gain ContentHtml (what is shown) and ContentFormat
(Markdown for local, Html for remote). Inbound Create and Update, and a
remote actor's biography, are sanitized on the way in; local posts store
their Markdig rendering. Migration _002 does the same to what is already
stored, and migrations now run at startup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Federation/Inbox/InboxService.cs

@@ -2,6 +2,7 @@ using MongoDB.Entities;
 
 using PrivaPub.Models.Federation;
 using PrivaPub.Models.Group;
+using PrivaPub.Models.Post;
 using PrivaPub.Models.User;
 using PrivaPub.StaticServices;
 
@@ -211,13 +212,16 @@ namespace PrivaPub.Federation.Inbox
 				if (await _dbEntities.Posts.Match(p => p.ObjectURI == objectUri).ExecuteAnyAsync(token))
 					return new(StatusCodes.Status202Accepted);
 
+				var html = ContentSanitizer.Html(Value(note, "content"));
 				var post = new PostEntity
 				{
 					ObjectURI = objectUri,
 					ActorURI = author.ActorURI,
 					GroupId = group?.Id,
 					Title = Value(note, "summary") ?? Value(note, "name"),
-					Text = Value(note, "content"),
+					Text = html,
+					ContentHtml = html,
+					ContentFormat = ContentFormat.Html,
 					HasContentWarning = note["sensitive"] is JsonValue sensitive && sensitive.TryGetValue<bool>(out var s) && s,
 					AnsweringToPostId = await LocalPostId(inReplyTo, token) ?? inReplyTo,
 					IsFederatedCopy = true,
@@ -241,13 +245,16 @@ namespace PrivaPub.Federation.Inbox
 
 			var participants = addressed.Where(a => a != ActivityPubRenderer.Public).Append(author.ActorURI).ToList();
 			var dmGroup = await FindOrCreateDmGroup(participants, Value(note, "context") ?? Value(note, "conversation"), token);
+			var dmHtml = ContentSanitizer.Html(Value(note, "content"));
 			var dm = new DmPostEntity
 			{
 				ObjectURI = objectUri,
 				ActorURI = author.ActorURI,
 				GroupId = dmGroup.ID,
 				Title = Value(note, "summary"),
-				Text = Value(note, "content"),
+				Text = dmHtml,
+				ContentHtml = dmHtml,
+				ContentFormat = ContentFormat.Html,
 				HasContentWarning = note["sensitive"] is JsonValue dmSensitive && dmSensitive.TryGetValue<bool>(out var ds) && ds,
 				AnsweringToPostId = inReplyTo,
 				IsFederatedCopy = true,
@@ -296,15 +303,17 @@ namespace PrivaPub.Federation.Inbox
 				return new(StatusCodes.Status202Accepted);
 
 			var objectUri = Id(inner);
-			var text = Value(inner, "content");
+			var text = ContentSanitizer.Html(Value(inner, "content"));
 			await DB.Default.Update<PostEntity>()
 				.Match(p => p.ObjectURI == objectUri && p.ActorURI == actor.ActorURI)
 				.Modify(p => p.Text, text)
+				.Modify(p => p.ContentHtml, text)
 				.Modify(p => p.UpdateDate, DateTime.UtcNow)
 				.ExecuteAsync(token);
 			await DB.Default.Update<DmPostEntity>()
 				.Match(p => p.ObjectURI == objectUri && p.ActorURI == actor.ActorURI)
 				.Modify(p => p.Text, text)
+				.Modify(p => p.ContentHtml, text)
 				.Modify(p => p.UpdateDate, DateTime.UtcNow)
 				.ExecuteAsync(token);
 			return new(StatusCodes.Status202Accepted);