Dynamic html needs to be sanetized

[bartbutenaers]

Hi guys,

Our friend @dceejay has reviewed my pull-request for html labels. He correctly mentioned that I needed to sanetize the html. While implementing a fix, I saw that the same problem does exist in many other places.

The dom-purify library is currently only used for the v-html in the ui-markdown node. But not for the v-html attribute in the following files:

• PropsTable.vue
• EventList.vue
• UIText.vue
• ControlsTable.vue
• MigrationPropertyTable.vue
• UIButton.vue
• UINotification.vue

Not sure whether all of these might impose a security risk, but I assume it is better to have a look at all of them.

If you want I can have a look at this...

Bart

[m-schaeffler]

👍

[bartbutenaers]

This has been implemented for all widgets. The remaining ones where about the documentation, but that seems not to be a security risk (see PR conversation). So for me this issue is completed.