pkp/pkp-lib#9421 replace v-html with v-strip-unsave-html

.gitignore

@@ -7,6 +7,7 @@ temp
 .project
 .buildpath
 .settings
+.vscode
 .DS_Store
 .php_cs.cache
 .php-cs-fixer.cache

package.json

@@ -15,6 +15,7 @@
     "chart.js": "^2.9.4",
     "clone-deep": "^4.0.1",
     "debounce": "^1.2.0",
+    "dompurify": "^3.0.8",
     "element-resize-event": "^3.0.3",
     "moment": "^2.29.2",
     "tinymce": "^5.10.0",

plugins/importexport/native/templates/index.tpl

@@ -85,7 +85,7 @@
 								/>
 								<span
 									class="listPanel__itemSubTitle"
-									v-html="localize(
+									v-strip-unsafe-html="localize(
 										item.publications.find(p => p.id == item.currentPublicationId).fullTitle,
 										item.publications.find(p => p.id == item.currentPublicationId).locale
 									)"

plugins/importexport/pubmed/templates/index.tpl

@@ -52,7 +52,7 @@
 									/>
 									<span 
 										class="listPanel__itemSubTitle" 
-										v-html="localize(
+										v-strip-unsafe-html="localize(
 											item.publications.find(p => p.id == item.currentPublicationId).fullTitle,
 											item.publications.find(p => p.id == item.currentPublicationId).locale
 										)"

plugins/pubIds/urn/js/FieldTextUrn.js

@@ -22,7 +22,7 @@ var template = pkp.Vue.compile('<div class="pkpFormField pkpFormField--text pkpF
 '			<div' +
 '				v-if="isPrimaryLocale && description"' +
 '				class="pkpFormField__description"' +
-'				v-html="description"' +
+'				v-strip-unsafe-html="description"' +
 '				:id="describedByDescriptionId"' +
 '			/>' +
 '			<div class="pkpFormField__control" :class="controlClasses">' +