Comment by jandrese

I'd also restrict the allowed CSS to the tiny portion of the spec that styles the text and maybe some basic layout. Definitely no scripting allowed.