Sustaining xss fixes

[Agrendalath]

This is a cherry-pick of a patch fixing XSS vulnerabilities (edx/edx-platform#24568).

[Agrendalath]

@taniwha, is there an upstream commit for this second fix? If so, please drop this one and use git cherry-pick -x COMMIT_HASH (-x will provide the original commit hash). This way we will preserve the proper commit history.

[taniwha]

@Agrendalath that would apply to all these PRs, right?

[Agrendalath]

@taniwha, that's correct.

[lgp171188]

@Agrendalath, except for the 3704eb2 commit, I don't see pointers to where the other commits are cherry-picked from and how they are related to the reported security issues and the corresponding fixes. Do you have any context about this?

[Agrendalath]

@lgp171188, I suppose this question is no longer relevant after your force push?

[lgp171188]

@lgp171188, I suppose this question is no longer relevant after your force push?

@Agrendalath, those commits still don't have any reference to upstream PRs. So I my question is still relevant. But since all those commits are from someone outside OpenCraft, it is obvious that they are cherry-picks from upstream and I am okay with merging this PR as-is.

[lgp171188]

@Agrendalath, if you are okay with the changes in this PR, can you approve it? CC @kaizoku

[kaizoku]

👍

• [✓] I tested this: (verified changes match upstream as they are cherry-picked)
• [✓] I read through the code
• [n/a] I checked for accessibility issues
• [n/a] Includes documentation