fix(security): sanitize DOCX HTML output with DOMPurify to prevent XSS (#514)

Malicious DOCX files with embedded script/event-handler tags rendered
via mammoth.convertToHtml() + dangerouslySetInnerHTML without sanitization
could execute arbitrary JavaScript in the user's browser.

Fix: Install DOMPurify and sanitize mammoth's HTML output before
rendering, allowing only safe tags and attributes used by Word documents.

FCE: Cross-site scripting (XSS) via uploaded DOCX files

Author: MoeexT

frontend/package-lock.json

@@ -12,8 +12,10 @@
   },
   "dependencies": {
     "@reduxjs/toolkit": "^2.11.2",
+    "@types/dompurify": "^3.0.5",
     "@xyflow/react": "^12.8.3",
     "antd": "^5.27.0",
+    "dompurify": "^3.4.10",
     "i18next": "^25.8.0",
     "jssha": "^3.3.1",
     "jszip": "^3.10.1",

frontend/package.json

@@ -1,4 +1,5 @@
 import React, { useEffect, useState } from 'react';
+import DOMPurify from 'dompurify';
 import mammoth from 'mammoth';
 
 export interface DocxPreviewProps {
@@ -28,7 +29,15 @@ export const DocxPreview: React.FC<DocxPreviewProps> = ({
 
         const arrayBuffer = await blob.arrayBuffer();
         const result = await mammoth.convertToHtml({ arrayBuffer });
-        setHtml(result.value);
+        // Sanitize HTML to prevent XSS from malicious DOCX files (FCE)
+        const sanitized = DOMPurify.sanitize(result.value, {
+          ALLOWED_TAGS: ['h1','h2','h3','h4','h5','h6','p','br','hr','ul','ol','li',
+            'table','thead','tbody','tr','th','td','strong','em','b','i','u','s',
+            'a','img','sup','sub','pre','code','blockquote','span','div'],
+          ALLOWED_ATTR: ['href','target','src','alt','width','height','colspan',
+            'rowspan','style','class','id','data-*'],
+        });
+        setHtml(sanitized);
       } catch (err) {
         setError('Failed to convert Word document');
       } finally {