HTML Sanitizer

Requirements

• Export sanitizeHTML(html) as named and default, returning a serialized HTML fragment. This is a deliberately limited interview exercise, not a replacement for a maintained production sanitizer. Parse in an inert template and rebuild allowed content without executing or attaching the untrusted input.
• Allow only HTML-namespace elements p, br, b, strong, i, em, u, ul, ol, li, span, a, code, pre, blockquote, h1, h2, and h3. Retain text nodes; remove comments and other non-element/non-text nodes.
• Drop entire subtrees of script, style, iframe, object, embed, template, svg, math, form, input, button, select, textarea, link, meta, and base. Drop every non-HTML namespace subtree. Unwrap other disallowed elements, retaining their sanitized children in order.
• Allow title on any allowed element. Allow href only on a. Remove every other attribute, including event handlers, style, class, id, target, and data attributes. Browser parsing/serialization may normalize casing, entities, and malformed markup.
• For href, remove ASCII control/whitespace characters and DEL before inspection. Reject empty values, any backslash, protocol-relative URLs beginning //, and any URL whose resolved protocol is not http:, https:, or mailto:. Resolve relative paths, fragments, and queries against https://sanitizer.invalid/ only to validate; keep the normalized original value in the output.
• Use DOM parsing rather than regex tag replacement. Never mutate the source string, invoke script, insert unsanitized nodes into the live document, or require an HTML/CSS file. Attributes on dropped or unwrapped elements must not migrate to retained children.

Examples

Input: sanitizeHTML('<p onclick="run()">Hi <strong>there</strong><script>bad()</script></p>');
Output: <p>Hi <strong>there</strong></p>

Input: sanitizeHTML('<div><a href="javascript:bad()" target="_blank">Open</a></div>');
Output: <a>Open</a>