Sanitize comment markdown on the ReScript page (#877)

Comments on /rescript rendered marked output directly, so HTML in a
comment could run script in another visitor's browser. The React and
server component views already sanitize.

Pass the output through sanitize-html with the same defaults as
Comment.jsx, and add a system spec that fails without the fix.

Security: this closes a stored XSS on /rescript. Stored comments are
unchanged; they are sanitized when displayed.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: justin808

client/app/bundles/comments/rescript/CommentList/Comment/Comment.res

@@ -1,7 +1,8 @@
 @react.component
 let make = (~comment: Actions.Fetch.t, ~cssTransitionGroupClassNames) => {
   let rawMarkup = Marked.marked(comment.text, {gfm: true})
-  let innerHTML = {"__html": rawMarkup}
+  let sanitizedRawMarkup = SanitizeHtml.sanitize(rawMarkup)
+  let innerHTML = {"__html": sanitizedRawMarkup}
   let nodeRef = React.useRef(Js.Nullable.null)
 
   // The 500 must correspond to the 0.5s in:

client/app/bundles/comments/rescript/bindings/SanitizeHtml.res

@@ -0,0 +1 @@
+@module("sanitize-html") external sanitize: string => string = "default"

spec/rescript/rescript_spec.rb

@@ -29,6 +29,22 @@
     end
   end
 
+  describe "comment markdown rendering" do
+    before do
+      Comment.create!(
+        author: "Author",
+        text: '**bold** <img src="missing.png" onerror="window.xssRan = true"><script>window.xssRan = true</script>'
+      )
+      visit "/rescript"
+    end
+
+    it "keeps markdown formatting and removes unsafe HTML" do
+      expect(page).to have_css(".js-comment-text strong", text: "bold")
+      expect(page).to have_no_css(".js-comment-text img", visible: :all)
+      expect(page).to have_no_css(".js-comment-text script", visible: :all)
+    end
+  end
+
   describe "form submission functions" do
     let(:comment) { Comment.new(author: "Author", text: "This is a comment") }
     let(:author_field) { "comment_author" }