Remote announce Markdown is rendered as HTML without sanitization (XSS) #12

Contexte

App.js renders the remote announce (marian-m12l/studio/master/ANNOUNCE.md, fetched through EvergreenService) with dangerouslySetInnerHTML={{__html: marked(this.state.announce)}}. marked@^1.0.0 is EOL with known XSS issues (< 2.0) and its output is not sanitized, so anyone able to change that upstream file (or MITM the raw.githubusercontent.com fetch) can execute script in every STUdio user's browser. HTML from the i18n bundles is also injected unsanitized in a few places (lower risk, same fix).

Description

Sanitize every dangerouslySetInnerHTML sink. Upgrade marked to a maintained major and pass its output through DOMPurify.sanitize(...). Apply the same sanitizer to the t(...) HTML sinks so all raw HTML goes through one helper.

Fichiers concernes

• web-ui/javascript/package.json:23 — bump marked (>= 4, last version still building under react-scripts 3 / Node 12), add dompurify
• web-ui/javascript/src/utils/html.js (new) — renderMarkdown(md) and sanitizeHtml(html) helpers wrapping DOMPurify
• web-ui/javascript/src/App.js:12, 204 — use renderMarkdown
• web-ui/javascript/src/components/PackLibrary.js:415, 425 — use sanitizeHtml(t(...))
• web-ui/javascript/src/components/diagram/widgets/PackDiagramWidget.js:374-375 — use sanitizeHtml(t(...))
• web-ui/javascript/src/utils/html.test.js (new) — <script>, onerror= and javascript: payloads are stripped, benign Markdown (links, bold, lists) survives

Plan d'implementation

1. Add dompurify, bump marked; adapt the import (import { marked } from 'marked' on >= 4).
2. Create utils/html.js with the two helpers.
3. Replace the four sinks.
4. Add unit tests for the helper with XSS payloads and a benign Markdown sample.
5. yarn test and yarn build green; yarn.lock updated and committed.

Criteres d'acceptation

• No dangerouslySetInnerHTML receives unsanitized HTML
• marked >= 4 and dompurify present in package.json and yarn.lock
• Tests prove script/event-handler/javascript: payloads are removed and normal Markdown still renders
• yarn test and the Maven front build green on Ubuntu and Windows CI

Complexite

M