[HOLD for payment 2023-03-21] Validate string form fields for html

[ctkochan22]

Problem

As noted in this GH: #12268 , we were allowing users to submit workspace names with html tags. However, for most of these string form fields, we strip the html/xml tags in our WAF input rules. So even though we allow users to submit strings with tags in them, we filter them out without letting the user know and try to save the stripped-string on the php side.

cc @flodnv

Two examples I've found:

• Workspace name. Addressing here: Add workspace name validation in App #13978
• First and last name in DisplayNamePage.js

I'm sure there are a lot of others. Lets find them and do the following

• Make sure we have check on the php side
• Check them for html on the app client side
• Fix and test

Action Preformed

1. Go to Settings -> Profile
2. Add a string with html tags like <b> </b>
3. Verify that its stripped without any warning
   https://recordit.co/TTr47jOQSR

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~01ac69cf8741f82a09
• Upwork Job ID: 1618748539495436288
• Last Price Increase: 2023-01-26

List of instances

• LegalNamePage.js -- legalFirstName and legalLastName would filter out html

• AddressPage.js -- addressStreet, addressCity, and addressState would filter html

• DisplayNamePage.js

• AddDebitCardPage.js

• IdentityForm.js

• CloseAccountPage.js -- This input rule for "mesage" is ANYTHING so html is fine

[melvin-bot]

Triggered auto assignment to @greg-schroeder (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~01ac69cf8741f82a09

[greg-schroeder]

Oops, I just realized how this one was created - removing the standard checklist as this is already confirmed as a bug and Internal label applied.