Review html escaping strategy on vue.js codebase in stable-3_3_0 and stable-3_4_0

[jardakotesovec]

Description
Vue.js escape html by default, but to support html in translations and some metadata we use v-html on many places.

• Look into whether there is opportunity to reduce use of v-html
• Look into whether replacing v-html by html-sanitizer which allows subset of html tags would had meaningful security impact

[asmecher]

(Several Vue components are using {{ submissionTitle }} to present submission titles -- this will escape HTML elements that are legitimately there. This will also need to be fixed when we have a good partial filter.)

[jardakotesovec]

As first 'catch all' round, replacing v-html with v-pkp-allowed-html, which sanitise the inputs with restricted set of elements and attributes - same as allowed_html in config.inc.php. This is significant improvement over using v-html. These changes should be safe to be applied also for 3.3 and 3.4, without causing regressions.

OJS: pkp/ojs#4165
PKP: #9673
UI-LIBRARY: pkp/ui-library#320

It would be good to even reduce use of v-pkp-allowed-html to the minimum, which I will explore later for 3.5.

Goal is really not have any XSS opportunities in Vue.js code base. Should provide enough protection for cases like this - #9408

[jardakotesovec]

For 3.3 and 3.4 just simple replacement of v-html with v-strip-unsafe-html. Thats using dompurify, which is performant & security oriented html sanitiser with default 'html' profile. Keeping things simple just to address security. Having allowed tags is something we can introduce in 3.5.

3.3
ojs - pkp/ojs#4178
omp - pkp/omp#1519
ops - pkp/ops#634
ui-library - pkp/ui-library#325
pkp-lib - #9703

3.4
ojs - pkp/ojs#4177
omp - pkp/omp#1518
ops - pkp/ops#633
ui-library - pkp/ui-library#324
pkp-lib - #9702

Hope its all correctly created and setup.. Lets see whether tests pass.

ping @asmecher @jonasraoni on code review. Thank you!

[asmecher]

Reviewed all and merged stable-3_3_0 PRs; I've restarted the OJS stable-3_4_0 build to see if there was a temporary hiccough during the validation stage, or whether something's actually broken there.

(Edit: it's a missing ui-library submodule update. comment)

[asmecher]

Thanks, @jardakotesovec! I've merged the stable-3_3_0 and stable-3_4_0 PRs.

I've moved this back to the 3.3.0-17 milestone (where this will first be released) and added a note to #9717 referring back here, so when we revise our strategy on main we don't forget these aspects too. Therefore I'll close this issue as done.