Security: stop rendering raw HTML in blog markdown without sanitization

Summary

Blog markdown rendering enables raw HTML without sanitization.

Severity

High

Impact

Raw HTML embedded in markdown is rendered into the DOM instead of escaped, enabling stored XSS if markdown content is ever attacker-controlled or imported from an untrusted source.

Affected code

• website/src/components/blog/MarkdownFormatter.tsx:11-14,831-838
• mirrored copy in policyengine-app-v2-blog/app/src/components/blog/MarkdownFormatter.tsx:19-22,890-893

Details

ReactMarkdown is configured with rehypeRaw and no sanitizer.

Expected behavior

Either raw HTML should be disabled or the pipeline should include a strict sanitizer.

Suggested remediation

• Remove rehypeRaw, or
• Add rehype-sanitize with an explicit allowlist
• Add tests demonstrating malicious HTML is escaped or stripped

Start with the ReactMarkdown configuration in website/src/components/blog/MarkdownFormatter.tsx and compare the mirrored copy at policyengine-app-v2-blog/app/src/components/blog/MarkdownFormatter.tsx. Check how the current rehypeRaw setup handles malicious HTML, then add coverage showing that HTML is escaped or stripped. Done means both copies disable raw HTML or apply a strict sanitizer and the malicious-input tests pass.