Improve input sanitization of URL attributes

[ThorbenLindhauer]

This issue was imported from JIRA:

Field	Value
JIRA Link	CAM-13877
Reporter	@marstamm
Has restricted visibility comments	false

---

Currently, the information in the URL is treated as safe. This is not best practice.

Acceptance Criteria (Required on creation):

• Sanitize all URL components (path and query parameters) before accessing the data

Hints (Optional):

Options:

• Patch the routeProvider and locationProvider to escape dangerous strings on access
  Pro: all access using angular services covered
  Con: access over window.location not covered, patching angular internals might be tricky

• Create a URL watcher that replaces the URL as changes are made
  Pro: All access is covered
  Con: Might cause a feedback loop with other watchers

Links:

• is related to https://jira.camunda.com/browse/CAM-13876