Replace sanitize-html by dompurify in frontend

It's lighter and we don't have native dependencies warnings in web
browser

packages/core-utils/src/renderer/html.ts

@@ -1,11 +1,30 @@
+export function getDefaultSanitizedTags () {
+  return [ 'a', 'p', 'span', 'br', 'strong', 'em', 'ul', 'ol', 'li' ]
+}
+
+export function getDefaultSanitizedSchemes () {
+  return [ 'http', 'https' ]
+}
+
+export function getDefaultSanitizedHrefAttributes () {
+  return [ 'href', 'class', 'target', 'rel' ]
+}
+
+// ---------------------------------------------------------------------------
+
+// ---------------------------------------------------------------------------
+// sanitize-html
+// ---------------------------------------------------------------------------
+
 export function getDefaultSanitizeOptions () {
   return {
-    allowedTags: [ 'a', 'p', 'span', 'br', 'strong', 'em', 'ul', 'ol', 'li' ],
-    allowedSchemes: [ 'http', 'https' ],
+    allowedTags: getDefaultSanitizedTags(),
+    allowedSchemes: getDefaultSanitizedSchemes(),
     allowedAttributes: {
-      'a': [ 'href', 'class', 'target', 'rel' ],
+      'a': getDefaultSanitizedHrefAttributes(),
       '*': [ 'data-*' ]
     },
+
     transformTags: {
       a: (tagName: string, attribs: any) => {
         let rel = 'noopener noreferrer'
@@ -29,28 +48,9 @@ export function getTextOnlySanitizeOptions () {
   }
 }
 
-export function getCustomMarkupSanitizeOptions (additionalAllowedTags: string[] = []) {
-  const base = getDefaultSanitizeOptions()
-
-  return {
-    allowedTags: [
-      ...base.allowedTags,
-      ...additionalAllowedTags,
-      'div', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'img'
-    ],
-    allowedSchemes: [
-      ...base.allowedSchemes,
-
-      'mailto'
-    ],
-    allowedAttributes: {
-      ...base.allowedAttributes,
-
-      'img': [ 'src', 'alt' ],
-      '*': [ 'data-*', 'style' ]
-    }
-  }
-}
+// ---------------------------------------------------------------------------
+// Manual escapes
+// ---------------------------------------------------------------------------
 
 // Thanks: https://stackoverflow.com/a/12034334
 export function escapeHTML (stringParam: string) {