🛡️ Sentinel: [HIGH] Mitigate XSS in CodeBlock rendering via DOMPurify

Sanitize HTML string generated by Shiki before rendering it via `dangerouslySetInnerHTML` in CodeBlockEmbeddable and CodeBlockSidebar.

src/client/components/CodeBlockEmbeddable.tsx

@@ -1,4 +1,5 @@
 import { memo, useEffect, useState } from "react";
+import DOMPurify from "dompurify";
 import type { ExcalidrawProps } from "@excalidraw/excalidraw/types";
 import type {
   ExcalidrawEmbeddableElement,
@@ -57,7 +58,7 @@ const CodeBlockEmbeddable = memo(function CodeBlockEmbeddable({
       {html ? (
         <div
           className="codeblock-embeddable-html"
-          dangerouslySetInnerHTML={{ __html: html }}
+          dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }}
         />
       ) : (
         <pre className="codeblock-embeddable-fallback">

src/client/components/CodeBlockSidebar.tsx

@@ -1,4 +1,5 @@
 import { useEffect, useRef, useState } from "react";
+import DOMPurify from "dompurify";
 import {
   CODE_BLOCK_LANGUAGES,
   type CodeBlockDraftState,
@@ -75,7 +76,7 @@ function CodeBlockEditor({
         {html ? (
           <div
             className="codeblock-editor-highlight-html"
-            dangerouslySetInnerHTML={{ __html: html }}
+            dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }}
           />
         ) : (
           <pre className="codeblock-editor-highlight-fallback">