EXERCISE 1 — Sanitizing a rich-text comment with DOMPurify
===========================================================

GOAL: allow <b>, <i>, <a href> only; strip everything else.

const clean = DOMPurify.sanitize(dirty, {
  ALLOWED_TAGS: ["b", "i", "a"],
  ALLOWED_ATTR: ["href"],
});
element.innerHTML = clean;   // safe to insert

INPUT (dirty):
  <b>hi</b><img src=x onerror=alert(1)>

OUTPUT (clean):
  <b>hi</b>
  -> the <b>hi</b> is on the allowlist, so it's KEPT and renders bold.
  -> the <img ... onerror=...> is NOT on the allowlist, so the whole element
     (and its onerror handler) is DROPPED. Nothing executes.

Other examples of what gets removed by this config:
  <script>alert(1)</script>            -> removed entirely
  <a href="javascript:alert(1)">x</a>  -> the javascript: URL is stripped
       (DOMPurify blocks dangerous URL schemes; the <a> may remain without the
        unsafe href)
  <b onclick="alert(1)">x</b>          -> <b> kept, the onclick attribute
        dropped (onclick isn't in ALLOWED_ATTR, and handlers are blocked)

WHY ALLOWLISTING (NOT BLOCKLISTING) MAKES IT SAFE:
  - DOMPurify PARSES the input into a real DOM and then KEEPS ONLY the
    elements/attributes you explicitly permitted, discarding everything else
    BY DEFAULT. The decision is "is this on the safe list?" -- anything not on
    it (known or unknown, today or invented tomorrow) is removed.
  - A blocklist would instead try to ENUMERATE bad things to strip
    (<script>, onerror, ...), which fails against the infinite variants from
    Chapter 4 (case tricks, entities, no-script vectors, mXSS). You can't list
    them all.
  - Allowlisting flips the burden: the attacker can't smuggle anything in by
    finding a variant you forgot to block, because the default action is to
    DROP. Only the small, known-safe set survives. That's why it's complete by
    construction.

NOTES:
  - Because DOMPurify parses with a real HTML parser, it also handles
    malformed/mutating markup that regex "sanitizers" mishandle (mXSS).
  - Keep ALLOWED_TAGS/ATTR as NARROW as the feature needs; keep DOMPurify
    updated.