Escape visible projects object in current-projects.js to prevent Liquid injections

[BeckettOBrien]

Fixes #3257

What changes did you make and why did you make them ?

In assets/js/current-projects.js

• Escaped the visible_projects object with JSON.parse(decodeURIComponent())
• Rewrote lines 78-120 to work with the new visible_projects object
• Replaced all uses of project.projectAreas with project['project-area'] to work with the new method of parsing projects
• Changed line 89 to parse the project identification to an Integer to work with the new method of parsing projects
• Sanitizing the visible_projects object prevents possible Liquid injection attacks as described in the Hack for LA Liquid Injection Vulnerabilities Audit

Screenshots of Proposed Changes Of The Website (if any, please do not screen shot code changes)

Only changed code to sanitize inputs. No visual changes to the site.

[github-actions]

Want to review this pull request? Take a look at this documentation for a step by step guide!

From your project repository, check out a new branch and test the changes.

git checkout -b BeckettOBrien-escape-liquid-injection-3257 gh-pages
git pull https://github.com/BeckettOBrien/hfla-website.git escape-liquid-injection-3257

[BeckettOBrien]

One thing to consider before merging this is that some of the projects use HTML in their descriptions, which would no longer work after escaping liquid injections. For example, this is what the Undebate project card would look like after this issue is resolved:

I told @tamara-snyder about this in the original issue and I asked about it in the slack but I haven't gotten any responses yet so I thought I would create the PR and see if anyone has any thoughts.

[BeckettOBrien]

Leaving a note here about all the projects that use HTML tags in their descriptions that would need to be changed under this PR:

• Civic Tech Jobs
• Civic Tech Structure
• Design Systems
• Expunge Assist
• Home Unite Us
• Open Community Survey
• Undebate

[BeckettOBrien]

Closing because too many projects use HTML in their descriptions for escaping Liquid injections to be worthwhile