Cleaning html tags from text

[michellethomas]

There are a few cases where we are using d3.html() which intentionally doesn't escape html. In these cases if a user has data with html tags we are not escaping it so some js can be executed. For example if a group by column in a table has an html tag with an onerror, the onerror will get executed in the browser when the table renders.

Initially I tried to do this in some central place so that we didn't have to go into individual files in /visualizations but when looking into it more, it seems to happen when we are using d3.html(). Let me know if there's a better way to do this. I may have missed a few cases, mainly trying to quickly get a fix out for the most used visualizations.

@mistercrunch @graceguo-supercat

[codecov-io]

Codecov Report

Merging #4842 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #4842   +/-   ##
=======================================
  Coverage   76.96%   76.96%           
=======================================
  Files          44       44           
  Lines        8534     8534           
=======================================
  Hits         6568     6568           
  Misses       1966     1966

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e88b0b6...136580a. Read the comment docs.

[mistercrunch]

LGMT