BUG: XSS when add class name to Selector Manager

[zgeist]

GrapesJS version

• I confirm to use the latest version of GrapesJS

What browser are you using?

Chrome v102

Reproducible demo link

https://jsfiddle.net/szLp8h4n

Describe the bug

How to reproduce the bug?

1. Select any component
2. Add class name to Selector Manager like <a href="#"onclick='alert(123)'>check</a>
3. After click on class name, you got alert

What is the expected behavior?
Class name should be escaped

What is the current behavior?
javascript run in class name

Need add escape function to template https://github.com/artf/grapesjs/blob/dev/src/selector_manager/view/ClassTagView.ts#L13

Code of Conduct

• I agree to follow this project's Code of Conduct

[Rawne]

Also running into this XSS bug. For example adding "><img src=x onerror=alert('XSS')> to the classes of a component will cause it to pop up as well.

[artf]

Thanks for the report, will be fixed in the next release.

[zgeist]

Thanks a lot!