修复帖内 CSS 污染整页：前后端禁止 style 并消毒 HTML。

Co-authored-by: Cursor <cursoragent@cursor.com>

service/sanitize_html.go

@@ -0,0 +1,47 @@
+package service
+
+import (
+	"sync"
+
+	"github.com/microcosm-cc/bluemonday"
+)
+
+var (
+	postHTMLPolicyOnce sync.Once
+	postHTMLPolicy     *bluemonday.Policy
+)
+
+// postContentHTMLPolicy 帖子正文白名单：对齐前端编辑器产出，禁止 style/script 等泄漏或执行向量。
+func postContentHTMLPolicy() *bluemonday.Policy {
+	postHTMLPolicyOnce.Do(func() {
+		p := bluemonday.UGCPolicy()
+
+		// TipTap / Markdown 转换会用到的结构
+		p.AllowElements("div", "span", "u", "s", "center", "members-only")
+		p.AllowAttrs("class").OnElements(
+			"p", "div", "span", "pre", "code", "img", "a",
+			"h1", "h2", "h3", "h4", "h5", "h6",
+			"blockquote", "ul", "ol", "li", "table", "thead", "tbody", "tr", "th", "td",
+			"members-only",
+		)
+		p.AllowAttrs(
+			"data-locked", "data-length",
+			"data-code-copy", "data-lang", "data-full",
+			"data-image-group", "data-layout", "data-display",
+			"data-clear-float",
+		).Globally()
+		p.AllowAttrs("target", "rel").OnElements("a")
+		// bluemonday 默认会剥 style 标签与 style 属性；此处不再放行
+
+		postHTMLPolicy = p
+	})
+	return postHTMLPolicy
+}
+
+// SanitizePostHTML 清洗帖子 HTML，防止 <style> 等污染整页或脚本注入。
+func SanitizePostHTML(html string) string {
+	if html == "" {
+		return ""
+	}
+	return postContentHTMLPolicy().Sanitize(html)
+}