Sanitizing HTML from component label, tooltip and description

[robinmolen]

Closes open-formulieren/security-issues#36

Changes

Added a simplistic sanitize function that sanitizes component label, tooltip and description when saving the component. This function allows a list of HTML tags and attributes, based on what formbuilders are currently using. Any html tags/attributes, that aren't in the allow list, are removed (only their content remains).

Checklist

Check off the items that are completed or not relevant.

• Impact on features

  • Checked copying a form
  • Checked import/export of a form
  • Config checks in the configuration overview admin page
  • Problem detection in the admin email digest is handled

• Release management

  • I have labelled the PR as "needs-backport" accordingly

• I have updated the translations assets (you do NOT need to provide translations)

  • Ran ./bin/makemessages_js.sh
  • Ran ./bin/compilemessages_js.sh

• Dockerfile/scripts

  • Updated the Dockerfile with the necessary scripts from the ./bin folder

• Commit hygiene

  • Commit messages refer to the relevant Github issue
  • Commit messages explain the "why" of change, not the how

[codecov]

Codecov Report

Attention: Patch coverage is 96.15385% with 1 line in your changes missing coverage. Please review.

Project coverage is 96.74%. Comparing base (f8ac4ef) to head (1d1a642).
Report is 23 commits behind head on master.

Files with missing lines	Patch %	Lines
...openforms/forms/api/serializers/form_definition.py	90.90%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #5121      +/-   ##
==========================================
- Coverage   96.75%   96.74%   -0.01%     
==========================================
  Files         778      779       +1     
  Lines       26741    26774      +33     
  Branches     3474     3483       +9     
==========================================
+ Hits        25873    25903      +30     
- Misses        606      607       +1     
- Partials      262      264       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[robinmolen]

This functionality is only tested on backend api level. We cannot nicely test the frontend sanitizing, because e2e tests will just become bloated/ugly/unreadable.

[viktorvanwijk]

Nice :)