src/vs/base/browser/dom.ts/safeInnerHtml
export function safeInnerHtml(node: HTMLElement, value: string): void {
	const options: dompurify.Config = {
		ALLOWED_TAGS: ['a', 'button', 'blockquote', 'code', 'div', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'input', 'label', 'li', 'p', 'pre', 'select', 'small', 'span', 'strong', 'textarea', 'ul', 'ol'],
		ALLOWED_ATTR: ['href', 'data-href', 'data-command', 'target', 'title', 'name', 'src', 'alt', 'class', 'id', 'role', 'tabindex', 'style', 'data-code', 'width', 'height', 'align', 'x-dispatch', 'required', 'checked', 'placeholder', 'type'],
		RETURN_DOM: false,
		RETURN_DOM_FRAGMENT: false,
	};

	const hook = hookDomPurifyHrefAndSrcSanitizer(defaultSafeProtocols);
	try {
		const html = dompurify.sanitize(value, { ...options, RETURN_TRUSTED_TYPE: true });
		node.innerHTML = html as unknown as string;
	} finally {
		hook.dispose();
	}
}