Attempt to restrict XSS filtering

[ibacher]

Tries to limit the application of the XSS filter.

[dkayiwa]

Will this prevent someone from submitting stored XSS via our REST calls?

[ibacher]

In so far as they work on form parameters, it will. We need a slightly different solution for the REST API, though, as HTML-encoding will break anything where we expect the client to submit XML since, e.g.,

<?xml version="1.0"?>
<document />

Becomes

<?xml version="1.0"?>
<document />

which won’t be parsed correctly. Basically for REST, we need to HTML encode the values as they are deserialised.

[Abhxay]

Hey!

Just a small suggestion: I didn’t see any new or updated tests for this. Adding test coverage to check the filter behavior on form vs. non-form requests might help catch issues in the future