Fix for code scanning alert no. 1719: Client-side cross-site scripting

[iOvergaard]

Potential fix for https://github.com/umbraco/Umbraco-CMS/security/code-scanning/1719

To fix the issue, we need to sanitize or encode the window.location.href value before including it in the html string. The best approach is to use a library like DOMPurify to sanitize the value or encode it using a utility function to ensure it is safe for inclusion in HTML. This will prevent any malicious scripts from being executed.

Steps to fix:

1. Import a library like DOMPurify or use a built-in encoding function to sanitize or encode the window.location.href value.
2. Replace the direct usage of window.location.href in the html string with its sanitized or encoded version.
3. Ensure that the rest of the functionality remains unchanged.

[Copilot]

Pull Request Overview

This PR addresses a potential cross-site scripting vulnerability by sanitizing the URL passed to history.pushState within the media links workspace info app. The key changes include importing a sanitizeHTML utility, replacing the direct use of window.location.href with its sanitized version, and ensuring the security of the generated HTML.

Comments suppressed due to low confidence (1)

src/Umbraco.Web.UI.Client/src/packages/media/media/url/info-app/media-links-workspace-info-app.element.ts:114

• Ensure that the sanitizeHTML function robustly handles and escapes all potentially malicious input from window.location.href. Consider adding unit tests to verify that the sanitization is effective against various XSS attack vectors.

	<script>history.pushState(null, null, "${sanitizeHTML(window.location.href)}");</script>