Will Anderson
af480f6266
Replaces the need for product-level denylist sanitizers. Small state-machine parser; tag-and-attribute allowlist passed as JSON; URL scheme validation on href/src attrs (http, https, mailto, fragment, relative); whole-subtree drop for script/style/iframe/ object/embed/form (plus rarer media containers). No comment- wrapping (was fragile to comment-injection bypass via a literal --> inside an attacker-supplied attribute value). Also picks up the codegen and parser changes for first-class Instant/Duration types (postfix-literal time values, typed binop dispatch) that were sitting in tree alongside this work. Test corpus at tests/html_sanitizer/ covers the live attacker probes (script, iframe, form, javascript:, about:, data:, img onerror, onclick) plus structural attacks (comment-injection bypass, tab-in-scheme bypass, encoded payloads, malformed input, empty input, plain text). 29 cases, all green. Self-host fixed point holds at 5720 lines via the canonical el-compiler/src/compiler.el entry. Snapshot tagged at dist/platform/elc.20260502-1249-self-host. Backlog: bl-dc55ae07