I think just allowing a CSS textarea input that can be injected inside a <style> HTML tag is enough. If the input is HTML escaped (replace <, > and other danger

I think just allowing a CSS textarea input that can be injected inside a <style> HTML tag is enough. If the input is HTML escaped (replace <, > and other dangerous characters) then nothing should escape out of that tag. Thank you for considering this!