fix(frontend): sanitize markdown HTML rendering in Text widget

[Micsi]

Upstream Tracking

• Upstream PR: [Codex] fix(frontend): sanitize markdown HTML rendering in Text widget abeggled/openbridgeserver#551

Motivation

• The Text widget parsed stored Markdown with marked.parse() and injected the result via v-html, which allowed stored XSS when Markdown contains raw HTML and event handlers.
• Because page configs are persisted and viewers import the widget and JWTs are kept in localStorage, an attacker who can save a page could execute scripts in other users' sessions.

Description

• Added an escapeHtml() helper and registered a marked renderer html hook to escape raw HTML tokens before they are returned by the parser in frontend/src/widgets/Text/Widget.vue.
• Kept the existing Markdown parsing and rendering flow (marked.parse + v-html) to preserve formatting while neutralizing embedded HTML payloads.
• The change is minimal and targeted to the markdown-to-HTML boundary so widget behavior for normal Markdown remains unchanged.

Testing

• Ran the frontend type checker with cd frontend && npm run typecheck, which completed successfully.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f9c16d1a90

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Register marked renderer only once

Because this is a <script setup> component, marked.use(...) executes every time a Text widget instance is created, but marked is a shared singleton. That means each mount appends another renderer override to global state; on dashboards with many widgets (or repeated mount/unmount cycles), this accumulates unnecessary wrapper chains and can eventually trigger the recursion/performance failure mode documented by Marked for repeated use() calls in component code. Move this to a one-time module initialization (outside per-instance setup) or use an isolated Marked instance.

Useful? React with 👍 / 👎.