fix: keep lists, quotes and headings in the HTML plugins put into a message

lib/__tests__/plugin-host-composer.test.ts

@@ -66,6 +66,16 @@ describe('api.composer', () => {
     expect(handle.calls[1][1]).toContain('Hi');
   });
 
+  it('keeps lists, quotes and headings a plugin sends as HTML', async () => {
+    const handle = fakeHandle();
+    const { id } = registerComposer(handle);
+    await call(WRITE, 'composer.replaceSelection', id, { html: '<h3>Files</h3><ul><li><a href="https://cloud.example.org/s/1">a.pdf</a></li></ul><blockquote>q</blockquote>' });
+    const html = handle.calls[0][1] as string;
+    expect(html).toContain('<ul><li><a href="https://cloud.example.org/s/1">a.pdf</a></li></ul>');
+    expect(html).toContain('<h3>Files</h3>');
+    expect(html).toContain('<blockquote>q</blockquote>');
+  });
+
   it('reaches only a composer that is open, by the id it handed out', async () => {
     const { unregister } = registerComposer(fakeHandle());
     await expect(call(READ, 'composer.getBody', 'guess')).rejects.toThrow(/not open any more/);

lib/email-sanitization.ts

@@ -252,11 +252,24 @@ export function sanitizeSignatureHtmlForDisplay(html: string): string {
  *
  * An untrusted plugin runs in a null-origin iframe, but whatever it returns
  * here lands in the host document and in the message the user then sends, so
- * it gets the same allowlist as a user-authored signature: formatting, links,
+ * it gets the allowlist of a user-authored signature: formatting, links,
  * images and tables, no script, no event handlers, no external URI schemes.
+ * Plus the structure the composer itself can write (lists, quotes, headings,
+ * code), so a plugin's list of links or rewritten paragraph keeps its shape.
  */
+const PLUGIN_BODY_SANITIZE_CONFIG = {
+  ...SIGNATURE_SANITIZE_CONFIG,
+  ALLOWED_TAGS: [...SIGNATURE_SANITIZE_CONFIG.ALLOWED_TAGS, 'ul', 'ol', 'li', 'blockquote', 'h1', 'h2', 'h3', 'pre', 'code', 's', 'hr'],
+};
+
 export function sanitizePluginBodyHtml(html: string): string {
-  return sanitizeSignatureHtml(html);
+  if (!html?.trim()) return '';
+  DOMPurify.addHook('afterSanitizeAttributes', restrictSignatureImages);
+  try {
+    return DOMPurify.sanitize(html, PLUGIN_BODY_SANITIZE_CONFIG);
+  } finally {
+    DOMPurify.removeAllHooks();
+  }
 }
 
 /**