Config data needs to be encoded when embedded in html so you cannot inject scripts

[epixa]

This hasn't been released yet, but at the moment the alpha4 builds allow for script injection via configuration values from advanced settings. You should be able to trigger it by adding the following as the value for any non-json config value:

</script><script>alert('nooooo');</script>

[epixa]

I reverted that PR because it doesn't pass tests (locally or on CI), so this is still an open issue.