URL sanitizer for help pages

[tpurschke]

closing #3810
not using this sanitizer to protect _blazor calls as this is unnecessary and may break things

[SolidProgramming]

@tpurschke Maybe add some test cases from XSS_Filter_Evasion_Cheat_Sheet ?

good thinking but because of time-criticality I would like to postpone this - could you please create an issue for this which we can tackle later?

[Robin-Smets]

I would be happy to review this, but I dont have any clue how to test it. In respect of our short cut time window I would suggest, that the testing should be done, by somebody who is familiar with these kind of attacks, so that we dont have to spend the time I need to research this topic. Best would be if somebody who is familiar with this topic could do the testing and I could just witness the act, so that I know for the next time.

[tpurschke]

I would be happy to review this, but I dont have any clue how to test it. In respect of our short cut time window I would suggest, that the testing should be done, by somebody who is familiar with these kind of attacks, so that we dont have to spend the time I need to research this topic. Best would be if somebody who is familiar with this topic could do the testing and I could just witness the act, so that I know for the next time.

shall we have a quick call regarding this issue so that I can show you the ropes?

[Robin-Smets]

I would be happy to review this, but I dont have any clue how to test it. In respect of our short cut time window I would suggest, that the testing should be done, by somebody who is familiar with these kind of attacks, so that we dont have to spend the time I need to research this topic. Best would be if somebody who is familiar with this topic could do the testing and I could just witness the act, so that I know for the next time.

shall we have a quick call regarding this issue so that I can show you the ropes?

Let's do that tommorow.

[tpurschke]

@SolidProgramming @NilsPur adding some more eyes - your review is appreciated for this security fix

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[SolidProgramming]

The thing handeled with "MyRegex", "MyRegex1", "MyRegex2" is bad named. I would haven taken a look at the cleaning because i would have done this with more regex but i guess it's not needed anymore.