fix: ignore theme key when sanitizing strings for extra data

[Badmuts]

This fix ignores sanitization of the theme key in extraData. This causes a problem where theme filters don't work when a theme is used with the '&' character. This character gets escaped with the value &amp.

Another solution would be to sanitize the theme in the frontend widget so the api receives a sanitized theme like "Duurzaam &amp groen" instead of "Duurzaam & groen".

[nlsvgtr]

An even better solution would be to store the theme as id, not as a string.

[nlsvgtr]

Sanitation is mostly a security measure, and the solution chosen here is a potential security issue: if theme is defined in site.config.ideas.extraData as a string a user can upload arbitrary executable code:

{
   "extraData": {
    "theme": "Theme with script <script>alert(1)</script>"
  }
}

[Badmuts]

Sanitation is mostly a security measure, and the solution chosen here is a potential security issue: if theme is defined in site.config.ideas.extraData as a string a user can upload arbitrary executable code:

{
   "extraData": {
    "theme": "Theme with script <script>alert(1)</script>"
  }
}

I agree. This seemed the simplest solution at the time. The best solution would be to use the generated theme id from apostrophe but this would not be backwards compatible.

Maybe we can make theme a special key in extraData so that it can only contain values (themes) that are defined in apostrophe. But this only allows for validation on the frontend since themes are not stored in the site config but in apostrophe.

[nlsvgtr]

With the new tags system it should be possible to create a set of tags in the category 'theme' and use those. Frontend should then be updated of course. I'll add it to the Headless todo list.