Fix CVE-2025-62798: Sanitize HTML content to prevent XSS attacks (for sharp 8.0)

[rycks]

As i'm blocked by php 8.2 version on my server here is i hope a fix for the CVE-2025-62798:

• Add symfony/html-sanitizer and dompurify dependencies
• Create sanitize utility function using DOMPurify
• Apply sanitization to all v-html usages:
  • ShowPage title
  • Text field content
  • DataListRow HTML columns
  • ActionView notifications and dialogs
  • EmbedRenderer slots
  • GlobalSearch results
  • ListUpload text

[aguingand]

Thank you for this PR. I think sanitizing every v-html is not necessary. Could you sanitize only Show text field, DataListRow & show title ? Here is were we sanitize today : https://github.com/search?q=repo%3Acode16%2Fsharp+%28sanitize+OR+sanitizeVueTemplate%29+language%3AVue++OR+language%3ATypeScript+&type=code.

[aguingand]

We should use the same code than today here (

sharp/resources/js/utils/sanitize.ts

Lines 3 to 22 in d8d109b

	DOMPurify.addHook('afterSanitizeAttributes', function (node) {
	if (node.tagName === 'A' && !node.getAttribute('rel')?.includes('noopener')) {
	node.setAttribute('rel', `${node.getAttribute('rel') ?? ''} noopener`.trim());
	}
	});
	export function sanitize(html: string | null) {
	return html
	? DOMPurify.sanitize(html, {
	ADD_TAGS: ['iframe'],
	ADD_ATTR: ['target'],
	CUSTOM_ELEMENT_HANDLING: {
	tagNameCheck: () => true,
	attributeNameCheck: (name) => {
	return !name.match(/^(v-)|:|@|#/); // remove vue related attributes
	},
	},
	})
	: html;
	}

)

[aguingand]

We should have the other function sanitizeForVue() here & use it in TemplateRenderer.vue

Here is how we do it today in Sharp 9 :

sharp/resources/js/utils/sanitize.ts

Lines 24 to 27 in d8d109b

	// Separate function that sanitizes all rendered Vue template, '{{' & '}}' should always be escaped
	export function sanitizeVueTemplate(template: string) {
	return template.replaceAll('{{', '{{').replaceAll('}}', '}}');
	}

sharp/resources/js/components/TemplateRenderer.vue

Lines 6 to 21 in d8d109b

	import { sanitizeVueTemplate } from "@/utils/sanitize";
	const props = defineProps<{
	template: string,
	components?: Record<string, Component>,
	}>();
	const component = computed(() => ({
	components: {
	'sharp-card': Card,
	'sharp-card-content': CardContent,
	'sharp-badge': Badge,
	...props.components,
	},
	template: `<div data-sharp-template>${sanitizeVueTemplate(props.template ?? '')}</div>`,
	}));