Fix <RichTextField> XSS vulnerability

[fzaninotto]

Problem

<RichTextField> leverages the dangerouslySetInnerHTML attribute, expecting the value to be already sanitized server-side.

If it is not, a malicious user can execute an XSS attack by injecting malicious data.

Proof-of-concept:

    <RecordContextProvider
        value={{
            id: 1,
            body: `
<p>
<strong>War and Peace</strong> is a novel by the Russian author
<a href="https://en.wikipedia.org/wiki/Leo_Tolstoy" onclick="document.getElementById('stolendata').value='credentials';">Leo Tolstoy</a>,
published serially, then in its entirety in 1869.
</p>
<p onmouseover="document.getElementById('stolendata').value='credentials';">
It is regarded as one of Tolstoy's finest literary achievements and remains a classic of world literature.
</p>
<img src="x" onerror="document.getElementById('stolendata').value='credentials';" />
`,
        }}
    >
        <RichTextField source="body" />
        <hr />
        <div>
            <h4>Stolen data:</h4>
            <input id="stolendata" defaultValue="none" />
        </div>
    </RecordContextProvider>

Solution

Sanitize the value by default using DomPurify. This adds 8.6kB gzipped to the final bundle for people using <RichTextField>, but it's inevitable.

[fzaninotto]

Fixes GHSA-5jcr-82fh-339v