fix: security improvements to checklist input (#444)

* feat: sanitize input for checklists

* feat: add basic editor

* feat: use plain text editor for checklist items

* feat: remove key from user response

packages/shared/src/utils/index.ts

@@ -5,3 +5,4 @@ export * from "./email";
 export * from "./dueDateFilters";
 export * from "./s3";
 export * from "./mentions";
+export * from "./sanitize";

packages/shared/src/utils/sanitize.ts

@@ -0,0 +1,6 @@
+/**
+ * Strips all HTML tags from a string, returning plain text.
+ * Use this on any user-supplied text field before storing or displaying.
+ */
+export const stripHtml = (value: string): string =>
+  value.replace(/<[^>]*>/g, "").trim();