Add inja escape() function to HTML escape values

[elpaso]

This fixes GHSA-cr49-pm9v-m788

[benoitdm-oslandia]

LGTM

[github-actions]

🍎 MacOS Qt6 builds

Download MacOS Qt6 builds of this PR for testing.
This app is not notarized, run sudo xattr -d com.apple.quarantine /Applications/QGIS*.app to avoid the warning
(Built from commit d665246)

🪟 Windows Qt6 builds

Download Windows Qt6 builds of this PR for testing.
To execute locally, unzip the downloaded zip file and run bin\qgis-bin.exe in the extracted directory.
You might be prompted by Windows Defender click "Run anyway"
(Built from commit d665246)

[qgis-bot]

The backport to release-3_44 failed:

The process '/usr/bin/git' failed with exit code 1

stderr

error: could not apply d66524683b5... Add inja escape() function to HTML escape values
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

stdout

Auto-merging src/server/qgsserverogcapihandler.cpp
CONFLICT (content): Merge conflict in src/server/qgsserverogcapihandler.cpp
Auto-merging tests/src/python/test_qgsserver_api.py

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-release-3_44 release-3_44
# Navigate to the new working tree
cd .worktrees/backport-release-3_44
# Create a new branch
git switch --create backport-66616-to-release-3_44
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick d66524683b5fabfee4aacff8cc34ba5e6567e6d2
# Push it to GitHub
git push --set-upstream origin backport-66616-to-release-3_44
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-release-3_44

Then, create a pull request where the base branch is release-3_44 and the compare/head branch is backport-66616-to-release-3_44.

[benoitdm-oslandia]

Thanks @elpaso for the fix and to add me to the security team!

[elpaso]

Thanks @elpaso for the fix and to add me to the security team!

No problem, actually I was trying to grant you access to the whole security section but I didn't find a way to do it (I'm not very familiar with that).

Do you now have access to all the advisories?

Ideally we should have a security "github team" with all people in that group having access to all the security advisories.

[benoitdm-oslandia]

Do you now have access to all the advisories?

I am only seeing one, may be because there is only one to see?

Ideally we should have a security "github team" with all people in that group having access to all the security advisories.

Yes it would be great!

[jef-n]

@elpaso shouldn't this be merged to master?

[elpaso]

This fixes GHSA-cr49-pm9v-m788

Yes, I thought it was but I surely made a mistake in the process, here it is a new PR:

#67044

[jef-n]

Yes, I thought it was but I surely made a mistake in the process, here it is a new PR:

Me too, I wondered why it wasn't there while working on #66972 and wondered how it could be merged and reverted without a trace ;)