fix: sanitize html of all description fields

frontend/src/components/Modals/AssignmentForm.vue

@@ -66,7 +66,7 @@
 <script setup lang="ts">
 import { Button, Dialog, FormControl, TextEditor, toast } from 'frappe-ui'
 import { computed, reactive, watch } from 'vue'
-import { escapeHTML } from '@/utils'
+import { escapeHTML, sanitizeHTML } from '@/utils'
 
 const show = defineModel()
 const assignments = defineModel<Assignments>('assignments')
@@ -122,12 +122,13 @@ watch(show, (newVal) => {
 	}
 })
 
-const validateTitle = () => {
+const validateFields = () => {
 	assignment.title = escapeHTML(assignment.title.trim())
+	assignment.question = sanitizeHTML(assignment.question)
 }
 
 const saveAssignment = () => {
-	validateTitle()
+	validateFields()
 	if (props.assignmentID == 'new') {
 		createAssignment()
 	} else {

frontend/src/components/Modals/EditProfile.vue

@@ -104,9 +104,8 @@ import {
 } from 'frappe-ui'
 import { ref, reactive, watch } from 'vue'
 import { X } from 'lucide-vue-next'
-import { getFileSize, decodeEntities } from '@/utils'
+import { getFileSize, sanitizeHTML } from '@/utils'
 import Link from '@/components/Controls/Link.vue'
-import DOMPurify from 'dompurify'
 
 const reloadProfile = defineModel('reloadProfile')
 const hasLanguageChanged = ref(false)
@@ -157,22 +156,7 @@ const updateProfile = createResource({
 })
 
 const saveProfile = (close) => {
-	profile.bio = DOMPurify.sanitize(decodeEntities(profile.bio), {
-		ALLOWED_TAGS: [
-			'b',
-			'i',
-			'em',
-			'strong',
-			'a',
-			'p',
-			'br',
-			'ul',
-			'ol',
-			'li',
-			'img',
-		],
-		ALLOWED_ATTR: ['href', 'target', 'src'],
-	})
+	profile.bio = sanitizeHTML(profile.bio)
 	updateProfile.submit(
 		{},
 		{