dartdoc should sanitize html

[redcrossp]

I posted the following in a now-closed issue report re: dartdoc does not escape html:

This issue should be reopened for discussion. I recently found this problem when l labeling an input parameter in a comment; something like:

/// Generates a filtered image at <name>.bmp
void generateOutlineBitmap(String name, /* etc ... */) {

The generated html includes a name tag, and this exploit could be leveraged for harmful attacks. It seems that an html-generating program should sanitize its input for this.

Originally posted by @redcrossp in #1458 (comment)

Is there a reason this isn't the current behavior? Are steps being taken to implement this?

[redcrossp]

I see this relates to issues like #1529 (comment) and #1527 (comment), but why isn't simply all input escaped here?

[keertip]

You are right, this should be escaped. Not sure why all input is not escaped, will take a look.

[jcollins-g]

Dartdoc intentionally allows some html. However, right now it allows a very broad range of HTML to be encoded and it's not documented what we allow and don't. This should be locked down further.

[jcollins-g]

This is likely to be implemented via https://pub.dev/packages/sanitize_html.

[srawlins]

Done!