fix(markdown): use htmlparser2 instead of DOMPurify for Web Worker compatibility (#2039)

- Replace isomorphic-dompurify with htmlparser2 (works in Web Workers)
- Add sanitizeHtmlForMultimedia() for video/audio/source tag allowlisting
- Update tests to expect escaped (not stripped) disallowed tags

package-lock.json

@@ -24,6 +24,7 @@
 				"file-type": "^21.0.0",
 				"handlebars": "^4.7.8",
 				"highlight.js": "^11.7.0",
+				"htmlparser2": "^10.0.0",
 				"husky": "^9.0.11",
 				"ip-address": "^9.0.5",
 				"jsdom": "^22.0.0",
@@ -680,6 +681,7 @@
 			"resolved": "https://registry.npmjs.org/@aws-sdk/credential-providers/-/credential-providers-3.927.0.tgz",
 			"integrity": "sha512-CasoHKKE/K+6YcVqjE+v5dVyKqKBtfzZyvGi669HvJ1f4EPHbVRPPLIb0eAYd/aEmwHsB/nn9VnyN9Wq5OppUQ==",
 			"license": "Apache-2.0",
+			"peer": true,
 			"dependencies": {
 				"@aws-sdk/client-cognito-identity": "3.927.0",
 				"@aws-sdk/core": "3.927.0",
@@ -956,7 +958,6 @@
 			"resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.27.1.tgz",
 			"integrity": "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==",
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"@babel/helper-validator-identifier": "^7.27.1",
 				"js-tokens": "^4.0.0",
@@ -971,7 +972,6 @@
 			"resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.27.1.tgz",
 			"integrity": "sha512-D2hP9eA+Sqx1kBZgzxZh0y1trbuU+JoDkiEwqhQ36nodYqJwyEIhPSdMNd7lOm/4io72luTPWH20Yda0xOuUow==",
 			"license": "MIT",
-			"peer": true,
 			"engines": {
 				"node": ">=6.9.0"
 			}
@@ -1073,6 +1073,7 @@
 				}
 			],
 			"license": "MIT",
+			"peer": true,
 			"engines": {
 				"node": ">=18"
 			},
@@ -1096,6 +1097,7 @@
 				}
 			],
 			"license": "MIT",
+			"peer": true,
 			"engines": {
 				"node": ">=18"
 			}
@@ -3248,7 +3250,8 @@
 			"version": "0.34.41",
 			"resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
 			"integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
-			"license": "MIT"
+			"license": "MIT",
+			"peer": true
 		},
 		"node_modules/@smithy/abort-controller": {
 			"version": "4.2.4",
@@ -3861,6 +3864,7 @@
 			"integrity": "sha512-EMYTY4+rNa7TaRZYzCqhQslEkACEZzWc363jOYuc90oJrgvlWTcgqTxcGSIJim48hPaXwYlHyatRnnMmTFf5tA==",
 			"devOptional": true,
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@sveltejs/acorn-typescript": "^1.0.5",
 				"@types/cookie": "^0.6.0",
@@ -3893,6 +3897,7 @@
 			"integrity": "sha512-wojIS/7GYnJDYIg1higWj2ROA6sSRWvcR1PO/bqEyFr/5UZah26c8Cz4u0NaqjPeVltzsVpt2Tm8d2io0V+4Tw==",
 			"devOptional": true,
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@sveltejs/vite-plugin-svelte-inspector": "^4.0.1",
 				"debug": "^4.4.1",
@@ -3932,7 +3937,6 @@
 			"resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.17.tgz",
 			"integrity": "sha512-5IKx/Y13RsYd+sauPb2x+U/xZikHjolzfuDgTAl/Tdf3Q8rslRvC19NKDLgAJQ6wsqADk10ntlv08nPFw/gO/A==",
 			"license": "Apache-2.0",
-			"peer": true,
 			"dependencies": {
 				"tslib": "^2.8.0"
 			}
@@ -3978,7 +3982,6 @@
 			"resolved": "https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.6.1.tgz",
 			"integrity": "sha512-vq7fv0rnt+QTXgPxr5Hjc210p6YKq2kmdziLgnsZGgLJ9e6VAShx1pACLuRjd/AS/sr7phAR58OIIpf0LlmQNw==",
 			"license": "MIT",
-			"peer": true,
 			"engines": {
 				"node": ">=12",
 				"npm": ">=6"
@@ -4024,8 +4027,7 @@
 			"version": "5.0.4",
 			"resolved": "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz",
 			"integrity": "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==",
-			"license": "MIT",
-			"peer": true
+			"license": "MIT"
 		},
 		"node_modules/@types/chai": {
 			"version": "5.2.2",
@@ -4254,6 +4256,7 @@
 			"integrity": "sha512-tbsV1jPne5CkFQCgPBcDOt30ItF7aJoZL997JSF7MhGQqOeT3svWRYxiqlfA5RUdlHN6Fi+EI9bxqbdyAUZjYQ==",
 			"dev": true,
 			"license": "BSD-2-Clause",
+			"peer": true,
 			"dependencies": {
 				"@typescript-eslint/scope-manager": "6.21.0",
 				"@typescript-eslint/types": "6.21.0",
@@ -4652,6 +4655,7 @@
 			"resolved": "https://registry.npmjs.org/acorn/-/acorn-8.14.1.tgz",
 			"integrity": "sha512-OvQ/2pUDKmgfCg++xsTX1wGxfTaszcHVcTctW4UJB4hibJx2HXxxO5UmVgyjMa+ZDsiaf5wWLXYpRWMmBI0QHg==",
 			"license": "MIT",
+			"peer": true,
 			"bin": {
 				"acorn": "bin/acorn"
 			},
@@ -4835,7 +4839,6 @@
 			"resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.0.tgz",
 			"integrity": "sha512-b0P0sZPKtyu8HkeRAfCq0IfURZK+SuwMjY1UXGBU27wpAiTwQAIlq56IbIO+ytk/JjS1fMR14ee5WBBfKi5J6A==",
 			"license": "Apache-2.0",
-			"peer": true,
 			"dependencies": {
 				"dequal": "^2.0.3"
 			}
@@ -5101,6 +5104,7 @@
 				}
 			],
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"caniuse-lite": "^1.0.30001718",
 				"electron-to-chromium": "^1.5.160",
@@ -5770,8 +5774,45 @@
 			"version": "0.5.16",
 			"resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
 			"integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==",
+			"license": "MIT"
+		},
+		"node_modules/dom-serializer": {
+			"version": "2.0.0",
+			"resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-2.0.0.tgz",
+			"integrity": "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==",
 			"license": "MIT",
-			"peer": true
+			"dependencies": {
+				"domelementtype": "^2.3.0",
+				"domhandler": "^5.0.2",
+				"entities": "^4.2.0"
+			},
+			"funding": {
+				"url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
+			}
+		},
+		"node_modules/dom-serializer/node_modules/entities": {
+			"version": "4.5.0",
+			"resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+			"integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+			"license": "BSD-2-Clause",
+			"engines": {
+				"node": ">=0.12"
+			},
+			"funding": {
+				"url": "https://github.com/fb55/entities?sponsor=1"
+			}
+		},
+		"node_modules/domelementtype": {
+			"version": "2.3.0",
+			"resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
+			"integrity": "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/fb55"
+				}
+			],
+			"license": "BSD-2-Clause"
 		},
 		"node_modules/domexception": {
 			"version": "4.0.0",
@@ -5786,6 +5827,21 @@
 				"node": ">=12"
 			}
 		},
+		"node_modules/domhandler": {
+			"version": "5.0.3",
+			"resolved": "https://registry.npmjs.org/domhandler/-/domhandler-5.0.3.tgz",
+			"integrity": "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==",
+			"license": "BSD-2-Clause",
+			"dependencies": {
+				"domelementtype": "^2.3.0"
+			},
+			"engines": {
+				"node": ">= 4"
+			},
+			"funding": {
+				"url": "https://github.com/fb55/domhandler?sponsor=1"
+			}
+		},
 		"node_modules/dompurify": {
 			"version": "3.3.0",
 			"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.0.tgz",
@@ -5796,6 +5852,20 @@
 				"@types/trusted-types": "^2.0.7"
 			}
 		},
+		"node_modules/domutils": {
+			"version": "3.2.2",
+			"resolved": "https://registry.npmjs.org/domutils/-/domutils-3.2.2.tgz",
+			"integrity": "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==",
+			"license": "BSD-2-Clause",
+			"dependencies": {
+				"dom-serializer": "^2.0.0",
+				"domelementtype": "^2.3.0",
+				"domhandler": "^5.0.3"
+			},
+			"funding": {
+				"url": "https://github.com/fb55/domutils?sponsor=1"
+			}
+		},
 		"node_modules/dotenv": {
 			"version": "16.5.0",
 			"resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.5.0.tgz",
@@ -5845,6 +5915,7 @@
 			"resolved": "https://registry.npmjs.org/elysia/-/elysia-1.3.4.tgz",
 			"integrity": "sha512-kAfM3Zwovy3z255IZgTKVxBw91HbgKhYl3TqrGRdZqqr+Fd+4eKOfvxgaKij22+MZLczPzIHtscAmvfpI3+q/A==",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"cookie": "^1.0.2",
 				"exact-mirror": "0.1.2",
@@ -6045,6 +6116,7 @@
 			"deprecated": "This version is no longer supported. Please see https://eslint.org/version-support for other options.",
 			"dev": true,
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@eslint-community/eslint-utils": "^4.2.0",
 				"@eslint-community/regexpp": "^4.6.1",
@@ -6682,6 +6754,7 @@
 			"resolved": "https://registry.npmjs.org/file-type/-/file-type-21.0.0.tgz",
 			"integrity": "sha512-ek5xNX2YBYlXhiUXui3D/BXa3LdqPmoLJ7rqEx2bKJ7EAUEfmXgW0Das7Dc6Nr9MvqaOnIqiPV0mZk/r/UpNAg==",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@tokenizer/inflate": "^0.2.7",
 				"strtok3": "^10.2.2",
@@ -7213,6 +7286,25 @@
 				"node": ">=12"
 			}
 		},
+		"node_modules/htmlparser2": {
+			"version": "10.0.0",
+			"resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-10.0.0.tgz",
+			"integrity": "sha512-TwAZM+zE5Tq3lrEHvOlvwgj1XLWQCtaaibSN11Q+gGBAS7Y1uZSWwXXRe4iF6OXnaq1riyQAPFOBtYc77Mxq0g==",
+			"funding": [
+				"https://github.com/fb55/htmlparser2?sponsor=1",
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/fb55"
+				}
+			],
+			"license": "MIT",
+			"dependencies": {
+				"domelementtype": "^2.3.0",
+				"domhandler": "^5.0.3",
+				"domutils": "^3.2.1",
+				"entities": "^6.0.0"
+			}
+		},
 		"node_modules/http-errors": {
 			"version": "2.0.0",
 			"resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz",
@@ -7822,8 +7914,7 @@
 			"version": "4.0.0",
 			"resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
 			"integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
-			"license": "MIT",
-			"peer": true
+			"license": "MIT"
 		},
 		"node_modules/js-yaml": {
 			"version": "4.1.0",
@@ -9601,6 +9692,7 @@
 			"integrity": "sha512-cJW4Xd/G3v5ovXtJJ52MAOclqeac9S/aGGgRzLabuF8TnIb6xHvMzKIa6JmrRzUkeXJgfL1MhukP0NK6l39h3A==",
 			"devOptional": true,
 			"license": "Apache-2.0",
+			"peer": true,
 			"dependencies": {
 				"playwright-core": "1.55.1"
 			},
@@ -9646,6 +9738,7 @@
 				}
 			],
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"nanoid": "^3.3.11",
 				"picocolors": "^1.1.1",
@@ -9877,6 +9970,7 @@
 			"integrity": "sha512-QQtaxnoDJeAkDvDKWCLiwIXkTgRhwYDEQCghU9Z6q03iyek/rxRh/2lC3HB7P8sWT2xC/y5JDctPLBIGzHKbhw==",
 			"dev": true,
 			"license": "MIT",
+			"peer": true,
 			"bin": {
 				"prettier": "bin/prettier.cjs"
 			},
@@ -9893,6 +9987,7 @@
 			"integrity": "sha512-pn1ra/0mPObzqoIQn/vUTR3ZZI6UuZ0sHqMK5x2jMLGrs53h0sXhkVuDcrlssHwIMk7FYrMjHBPoUSyyEEDlBQ==",
 			"dev": true,
 			"license": "MIT",
+			"peer": true,
 			"peerDependencies": {
 				"prettier": "^3.0.0",
 				"svelte": "^3.2.0 || ^4.0.0-next.0 || ^5.0.0-next.0"
@@ -9982,7 +10077,6 @@
 			"resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
 			"integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
 			"license": "MIT",
-			"peer": true,
 			"dependencies": {
 				"ansi-regex": "^5.0.1",
 				"ansi-styles": "^5.0.0",
@@ -9997,7 +10091,6 @@
 			"resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
 			"integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
 			"license": "MIT",
-			"peer": true,
 			"engines": {
 				"node": ">=10"
 			},
@@ -10206,8 +10299,7 @@
 			"version": "17.0.2",
 			"resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
 			"integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
-			"license": "MIT",
-			"peer": true
+			"license": "MIT"
 		},
 		"node_modules/read-cache": {
 			"version": "1.0.0",
@@ -10371,6 +10463,7 @@
 			"resolved": "https://registry.npmjs.org/rollup/-/rollup-4.41.1.tgz",
 			"integrity": "sha512-cPmwD3FnFv8rKMBc1MxWCwVQFxwf1JEmSX3iQXrRVVG15zerAIXRjMFVWnd5Q5QvgKF7Aj+5ykXFhUl+QGnyOw==",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@types/estree": "1.0.7"
 			},
@@ -11289,6 +11382,7 @@
 			"resolved": "https://registry.npmjs.org/svelte/-/svelte-5.33.14.tgz",
 			"integrity": "sha512-kRlbhIlMTijbFmVDQFDeKXPLlX1/ovXwV0I162wRqQhRcygaqDIcu1d/Ese3H2uI+yt3uT8E7ndgDthQv5v5BA==",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@ampproject/remapping": "^2.3.0",
 				"@jridgewell/sourcemap-codec": "^1.5.0",
@@ -11428,6 +11522,7 @@
 			"resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.17.tgz",
 			"integrity": "sha512-w33E2aCvSDP0tW9RZuNXadXlkHXqFzSkQew/aIa2i/Sj8fThxwovwlXHSPXTbAHwEIhBFXAedUhP2tueAKP8Og==",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@alloc/quick-lru": "^5.2.0",
 				"arg": "^5.0.2",
@@ -11885,6 +11980,7 @@
 			"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.8.3.tgz",
 			"integrity": "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==",
 			"license": "Apache-2.0",
+			"peer": true,
 			"bin": {
 				"tsc": "bin/tsc",
 				"tsserver": "bin/tsserver"
@@ -12120,6 +12216,7 @@
 			"resolved": "https://registry.npmjs.org/vite/-/vite-6.3.5.tgz",
 			"integrity": "sha512-cZn6NDFE7wdTpINgs++ZJ4N49W2vRp8LCKrn3Ob1kYNtOo21vfDoaV5GzBfLU4MovSAB8uNRm4jgzVQZ+mBzPQ==",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"esbuild": "^0.25.0",
 				"fdir": "^6.4.4",
@@ -12255,6 +12352,7 @@
 			"resolved": "https://registry.npmjs.org/vitest/-/vitest-3.2.2.tgz",
 			"integrity": "sha512-fyNn/Rp016Bt5qvY0OQvIUCwW2vnaEBLxP42PmKbNIoasSYjML+8xyeADOPvBe+Xfl/ubIw4og7Lt9jflRsCNw==",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@types/chai": "^5.2.2",
 				"@vitest/expect": "3.2.2",
@@ -12577,6 +12675,7 @@
 			"resolved": "https://registry.npmjs.org/ws/-/ws-8.18.2.tgz",
 			"integrity": "sha512-DMricUmwGZUVr++AEAe2uiVM7UoO9MAVZMDu05UQOaUII0lp+zOzLLU4Xqh/JvTqklB1T4uELaaPBKyjE1r4fQ==",
 			"license": "MIT",
+			"peer": true,
 			"engines": {
 				"node": ">=10.0.0"
 			},
@@ -12699,6 +12798,7 @@
 			"resolved": "https://registry.npmjs.org/zod/-/zod-3.25.55.tgz",
 			"integrity": "sha512-219huNnkSLQnLsQ3uaRjXsxMrVm5C9W3OOpEVt2k5tvMKuA8nBSu38e0B//a+he9Iq2dvmk2VyYVlHqiHa4YBA==",
 			"license": "MIT",
+			"peer": true,
 			"funding": {
 				"url": "https://github.com/sponsors/colinhacks"
 			}

package.json

@@ -83,6 +83,7 @@
 		"file-type": "^21.0.0",
 		"handlebars": "^4.7.8",
 		"highlight.js": "^11.7.0",
+		"htmlparser2": "^10.0.0",
 		"husky": "^9.0.11",
 		"ip-address": "^9.0.5",
 		"jsdom": "^22.0.0",

src/lib/components/chat/MarkdownRenderer.svelte.test.ts

@@ -32,8 +32,8 @@ describe("MarkdownRenderer", () => {
 	it("doesnt render raw html directly", () => {
 		render(MarkdownRenderer, { content: "<button>Click me</button>" });
 		expect(page.getByRole("button").elements).toHaveLength(0);
-		// DOMPurify strips disallowed tags but preserves text content
-		expect(page.getByRole("paragraph")).toHaveTextContent("Click me");
+		// htmlparser2 escapes disallowed tags
+		expect(page.getByRole("paragraph")).toHaveTextContent("<button>Click me</button>");
 	});
 	it("renders latex", () => {
 		const { baseElement } = render(MarkdownRenderer, { content: "$(oo)^2$" });

src/lib/utils/marked.spec.ts

@@ -79,9 +79,10 @@ describe("marked html video tag support", () => {
 		expect(html).not.toContain("javascript:");
 	});
 
-	test("strips disallowed html tags", () => {
+	test("escapes disallowed html tags", () => {
 		const html = renderHtml("<script>alert(1)</script>");
 		expect(html).not.toContain("<script>");
+		expect(html).toContain("&lt;script&gt;");
 	});
 
 	test("allows <audio> tags with controls", () => {

src/lib/utils/marked.ts

@@ -2,7 +2,7 @@ import katex from "katex";
 import "katex/dist/contrib/mhchem.mjs";
 import { Marked } from "marked";
 import type { Tokens, TokenizerExtension, RendererExtension } from "marked";
-import DOMPurify from "isomorphic-dompurify";
+import { parseDocument } from "htmlparser2";
 // Simple type to replace removed WebSearchSource
 type SimpleSource = {
 	title?: string;
@@ -57,24 +57,6 @@ const bundledLanguages: [string, LanguageFn][] = [
 
 bundledLanguages.forEach(([name, language]) => hljs.registerLanguage(name, language));
 
-// DOMPurify config for allowing video/audio tags in markdown
-const DOMPURIFY_CONFIG = {
-	ALLOWED_TAGS: ["video", "audio", "source"],
-	ALLOWED_ATTR: [
-		"src",
-		"type",
-		"controls",
-		"autoplay",
-		"loop",
-		"muted",
-		"playsinline",
-		"poster",
-		"width",
-		"height",
-		"preload",
-	],
-};
-
 // Media URL detection
 const VIDEO_EXTENSIONS = /\.(mp4|webm|ogg|mov|m4v)([?#]|$)/i;
 const AUDIO_EXTENSIONS = /\.(mp3|wav|m4a|aac|flac)([?#]|$)/i;
@@ -87,6 +69,34 @@ function isAudioUrl(url: string): boolean {
 	return AUDIO_EXTENSIONS.test(url);
 }
 
+// Multimedia HTML sanitization (works in Web Workers - no DOM needed)
+const MULTIMEDIA_TAGS = new Set(["video", "source", "audio"]);
+const MULTIMEDIA_ALLOWED_ATTRS = new Set([
+	"src",
+	"type",
+	"controls",
+	"autoplay",
+	"loop",
+	"muted",
+	"playsinline",
+	"poster",
+	"width",
+	"height",
+	"preload",
+]);
+const MULTIMEDIA_BOOLEAN_ATTRS = new Set(["controls", "autoplay", "loop", "muted", "playsinline"]);
+const MULTIMEDIA_URI_ATTRS = new Set(["src", "poster"]);
+const MULTIMEDIA_ALLOWED_URI_PATTERN = /^(?!javascript:|data:text\/html)/i;
+const MULTIMEDIA_HTML_REGEX = /<\/?(video|source|audio)\b/i;
+
+type HtmlNode = {
+	type: string;
+	name?: string;
+	attribs?: Record<string, string>;
+	children?: HtmlNode[];
+	data?: string;
+};
+
 interface katexBlockToken extends Tokens.Generic {
 	type: "katexBlock";
 	raw: string;
@@ -256,6 +266,82 @@ function highlightCode(text: string, lang?: string): string {
 	return hljs.highlightAuto(text).value;
 }
 
+function sanitizeMediaUrl(value: string): string | undefined {
+	const trimmed = value.trim().replace(/>$/, "");
+	if (!MULTIMEDIA_ALLOWED_URI_PATTERN.test(trimmed)) return undefined;
+	return trimmed;
+}
+
+function serializeMediaAttributes(attribs?: Record<string, string>): string {
+	if (!attribs) return "";
+	const parts: string[] = [];
+	for (const [rawName, rawValue] of Object.entries(attribs)) {
+		const name = rawName.toLowerCase();
+		if (!MULTIMEDIA_ALLOWED_ATTRS.has(name)) continue;
+		if (MULTIMEDIA_BOOLEAN_ATTRS.has(name)) {
+			parts.push(name);
+			continue;
+		}
+		let value = rawValue ?? "";
+		if (MULTIMEDIA_URI_ATTRS.has(name)) {
+			const safeUrl = sanitizeMediaUrl(value);
+			if (!safeUrl) continue;
+			value = safeUrl;
+		}
+		parts.push(`${name}="${escapeHTML(value)}"`);
+	}
+	return parts.length ? ` ${parts.join(" ")}` : "";
+}
+
+function serializeMediaNode(node: HtmlNode, state: { hasDisallowedTag: boolean }): string {
+	if (node.type === "text") {
+		return escapeHTML(node.data ?? "");
+	}
+	if (node.type === "tag" || node.type === "script" || node.type === "style") {
+		const tagName = node.name?.toLowerCase() ?? "";
+		if (!MULTIMEDIA_TAGS.has(tagName)) {
+			state.hasDisallowedTag = true;
+			return "";
+		}
+		const attrs = serializeMediaAttributes(node.attribs);
+		if (tagName === "source") {
+			return `<source${attrs}>`;
+		}
+		const children = (node.children ?? [])
+			.map((child) => serializeMediaNode(child, state))
+			.join("");
+		return `<${tagName}${attrs}>${children}</${tagName}>`;
+	}
+	if (node.type === "comment") {
+		return "";
+	}
+	return "";
+}
+
+/**
+ * Sanitizes HTML to allow only video/audio/source tags with safe attributes.
+ * Uses htmlparser2 which works in Web Workers (no DOM needed).
+ * If any disallowed tags are found, escapes the entire input.
+ */
+function sanitizeHtmlForMultimedia(html: string): string {
+	if (!MULTIMEDIA_HTML_REGEX.test(html)) {
+		return escapeHTML(html);
+	}
+	const document = parseDocument(html, {
+		lowerCaseAttributeNames: true,
+		lowerCaseTags: true,
+		recognizeSelfClosing: true,
+	}) as unknown as { children: HtmlNode[] };
+	const state = { hasDisallowedTag: false };
+	const sanitized = (document.children ?? [])
+		.map((child) => serializeMediaNode(child, state))
+		.join("");
+	if (state.hasDisallowedTag) {
+		return escapeHTML(html);
+	}
+	return sanitized;
+}
+
 function createMarkedInstance(sources: SimpleSource[]): Marked {
 	return new Marked({
 		hooks: {
@@ -285,7 +371,7 @@ function createMarkedInstance(sources: SimpleSource[]): Marked {
 				}
 				return `<img src="${safeSrc}" alt="${safeAlt}"${safeTitle} />`;
 			},
-			html: (html) => DOMPurify.sanitize(html, DOMPURIFY_CONFIG),
+			html: (html) => sanitizeHtmlForMultimedia(html),
 		},
 		gfm: true,
 		breaks: true,