fix: content sanitization in getimage endpoint (#2241)

plugin/http-getter/image.go

@@ -6,6 +6,8 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+
+	"github.com/microcosm-cc/bluemonday"
 )
 
 type Image struct {
@@ -37,9 +39,21 @@ func GetImage(urlStr string) (*Image, error) {
 		return nil, err
 	}
 
+	bodyBytes, err = SanitizeContent(bodyBytes)
+	if err != nil {
+		return nil, err
+	}
+
 	image := &Image{
 		Blob:      bodyBytes,
 		Mediatype: mediatype,
 	}
 	return image, nil
 }
+
+func SanitizeContent(content []byte) ([]byte, error) {
+	bodyString := string(content)
+
+	bm := bluemonday.UGCPolicy()
+	return []byte(bm.Sanitize(bodyString)), nil
+}