XSS on the Dashboard

The username (and possibly other fields) of the user profile are not escaped properly on the dashboard.

Consequently, any user consulting the user profile executes the javascript code located in the user name.

From a first quick investigation, the issue seems to be only located on the dashboard.

See https://git.radicallyopensecurity.com/ros/off-nlnet-ngid-xwiki_activitypub/-/issues/14

Reproduction Steps:

• Create an account with XSS payload in Firstname and/or lastname

Expected Result:

• XSS payload should be filtered

Obtained Result:

• From the created account:
  • Go to ActivityPub Dashboard, XSS can be triggered there
• From an other account:
  • Go to attacker account profile page, then ActivityPub profile section, XSS can be triggered there