[irshadmb]

Fixes a serveral-source injection/XSS risk reported by Snyk that originates from Editor.getHTML / convertHTML returning raw DOM HTML for some blots. The change sanitizes HTML produced by the editor export so user-supplied or blot-provided HTML cannot execute script or other active content when rendered in a browser.
What I changed

Sanitize HTML produced by Editor.getHTML / convertHTML instead of returning outerHTML/innerHTML verbatim.
Remove/neutralize dangerous elements: script, iframe, object, embed, style, and similar executable/embedded elements.
Strip dangerous attributes from elements:
Remove all event handler attributes (onclick, onerror, etc.).
Remove style attributes (to avoid style-based attacks such as style-propagated URLs or expression injection).
Only allow a small whitelist of safe attributes: href, src, alt, title, width, height, colspan, rowspan, plus data-* attributes.
Validate attribute values for URL attributes:
Disallow javascript: scheme and other unsafe schemes.
Deny or strictly limit data: URIs (only allow image data: if you choose to support it, otherwise strip).
Normalize and escape attribute values when reconstructing HTML.
Reconstruct and serialize elements from their tag/allowed attributes and sanitized children (safe re-serialization) rather than copying blot.domNode.outerHTML/innerHTML directly.
Preserve benign content and common structures: lists, tables, images, anchors, and inline content are preserved as long as attributes/values are safe.
Keep existing behavior for TextBlot and list serialization but ensure text and attributes are escaped/sanitized.
Security rationale

Returning outerHTML/innerHTML directly can expose consumers to XSS if a blot or content contains scriptable HTML or unsafe attributes.
Stripping dangerous tags and attributes plus validating URL schemes prevents execution of injected JavaScript or inclusion of malicious iframes/objects.
Reconstructing elements from allowed parts prevents subtle injection vectors from attributes or inner HTML fragments.
Tests and verification

Unit tests (recommended):
getHTML of content containing <script>, <iframe>, , , <style> should return sanitized HTML without those elements.
getHTML of elements with event handlers (onclick, onerror, etc.) returns the element without event attributes.
getHTML of anchors/images with javascript: or unsafe data: URIs strips or neutralizes the href/src attribute.
getHTML of normal content (links, images, lists, tables, code blocks) preserves expected structure and safe attributes.
Manual checks:
Insert malicious markup into the editor, call getHTML, and verify rendered result in a target page does not execute code.
Verify non-malicious content still renders correctly after export.

[irshadmb]

Please review it, as its a security issue.