Add safe_html() for XSS-safe WYSIWYG HTML sanitization

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/RSpade/Core/Js/functions.js

@@ -285,6 +285,23 @@ function html(str) {
     return _.escape(str);
 }
 
+/**
+ * Sanitizes HTML from WYSIWYG editors to prevent XSS attacks
+ *
+ * Uses DOMPurify to filter potentially malicious HTML while preserving
+ * safe formatting tags. Suitable for user-generated rich text content.
+ *
+ * @param {string} html_string - HTML string to sanitize
+ * @returns {string} Sanitized HTML safe for display
+ */
+function safe_html(html_string) {
+    return DOMPurify.sanitize(html_string, {
+        ALLOWED_TAGS: ['p', 'br', 'strong', 'b', 'em', 'i', 'u', 's', 'strike', 'a', 'ul', 'ol', 'li', 'blockquote', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'pre', 'code', 'img', 'table', 'thead', 'tbody', 'tr', 'th', 'td', 'div', 'span'],
+        ALLOWED_ATTR: ['href', 'title', 'target', 'src', 'alt', 'width', 'height', 'class'],
+        ALLOW_DATA_ATTR: false,
+    });
+}
+
 /**
  * Converts newlines to HTML line breaks
  * @param {string} str - String to convert