bugfix [v3] add satinize for xss

src/Commands/BadasoSetup.php

@@ -99,6 +99,7 @@ protected function updatePackageJson()
         $decoded_json['dependencies']['sass'] = '^1.32.11';
         $decoded_json['dependencies']['sass-loader'] = '^11.0.1';
         $decoded_json['dependencies']['resolve-url-loader'] = '^4.0.0';
+        $decoded_json['dependencies']['dompurify'] = '^3.0.5';
 
         $decoded_json['dependencies']['@johmun/vue-tags-input'] = '^2.1.0';
         $decoded_json['dependencies']['@tinymce/tinymce-vue'] = '^3';

src/resources/badaso/components/BadasoSelect.vue

@@ -10,8 +10,8 @@
     >
       <vs-select-item
         :key="index"
-        :value="item.value ? item.value : item"
-        :text="item.label ? item.label : item"
+        :value="satinize(item.value) ? satinize(item.value) : satinize(item)"
+        :text="satinize(item.label) ? satinize(item.label) : satinize(item)"
         v-for="(item, index) in items"
       />
     </vs-select>
@@ -34,6 +34,7 @@
 </template>
 
 <script>
+import * as DOMPurify from 'dompurify';
 export default {
   name: "BadasoSelect",
   components: {},
@@ -70,6 +71,9 @@ export default {
     },
   },
   methods: {
+    satinize(item) {
+      return DOMPurify.sanitize(item)
+    },
     handleInput(val) {
       this.$emit("input", val);
     },

src/resources/badaso/components/BadasoSelectMultiple.vue

@@ -11,8 +11,8 @@
     >
       <vs-select-item
         :key="index"
-        :value="item.value"
-        :text="item.label"
+        :value="satinize(item.value)"
+        :text="satinize(item.label)"
         v-for="(item, index) in items"
       />
     </vs-select>
@@ -38,6 +38,7 @@
 </template>
 
 <script>
+import * as DOMPurify from 'dompurify';
 export default {
   name: "BadasoSelectMultiple",
   components: {},
@@ -75,6 +76,9 @@ export default {
     },
   },
   methods: {
+    satinize(item) {
+      return DOMPurify.sanitize(item)
+    },
     handleInput(val) {
       this.$emit("input", val);
     },