Sanitize all the html content to solve security concerns

[ananzh]

From #2905 discussion, we found that we currently use dangerouslySetInnerHTML to let react know this is html content. There are multiple places in our code base using dangerouslySetInnerHTML

• fonts
  code reference:
  

  OpenSearch-Dashboards/src/core/server/rendering/views/fonts.tsx

  Line 257 in d7004dc

  dangerouslySetInnerHTML={{

• style
  

  OpenSearch-Dashboards/src/core/server/rendering/views/styles.tsx

  Line 44 in d7004dc

  dangerouslySetInnerHTML={{

• field
  

  OpenSearch-Dashboards/src/plugins/advanced_settings/public/management_app/components/field/field.tsx

  Line 558 in d7004dc

  dangerouslySetInnerHTML={{ __html: setting.description || '' }} // eslint-disable-line react/no-danger

• table_row in discover
  

  OpenSearch-Dashboards/src/plugins/discover/public/application/components/table/table_row.tsx

  Line 124 in d7004dc

  dangerouslySetInnerHTML={{ __html: value as string }}

• field_format_editor in index management
  

  OpenSearch-Dashboards/src/plugins/index_pattern_management/public/components/field_editor/components/field_format_editor/editors/url/label_template_flyout.tsx

  Line 151 in d7004dc

  dangerouslySetInnerHTML={{ __html: value }} // eslint-disable-line react/no-danger

OpenSearch-Dashboards/src/plugins/index_pattern_management/public/components/field_editor/components/field_format_editor/samples/samples.tsx

Line 76 in d7004dc

dangerouslySetInnerHTML={{ __html: output }} // eslint-disable-line react/no-danger

• markdown vis
  

  OpenSearch-Dashboards/src/plugins/opensearch_dashboards_react/public/markdown/markdown.tsx

  Line 144 in 54f2aeb

  dangerouslySetInnerHTML={{ __html: renderedMarkdown }} // eslint-disable-line react/no-danger

• metrics vis
  

  OpenSearch-Dashboards/src/plugins/vis_type_metric/public/components/metric_vis_value.tsx

  Line 94 in d7004dc

  dangerouslySetInnerHTML={{ __html: metric.value }} // eslint-disable-line react/no-danger

If XSS is really a concern and we think customer data is not trustful enough for security purpose, another way is to add dompurify. It is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

[joshuarrrr]

This can be done in addition to, or alternatively to #2932. Most of the examples here would go away if we ditch the HTML formatter.