Fix escape characters in categories

[Stef-Rousset]

🎩 Description

This PR removes escaping from categorie's names in FO.

Testing

As an admin, go to a process > Categories and update the name of a category, adding special characters (like '&"<>).
As a user, go to the proposals of the process and see that the category's name you have updated is displayed with its special characters not escaped.

📌 Related Issues

Link your PR to an issue

• Fixes https://github.com/orgs/OpenSourcePolitics/projects/26/views/1?pane=issue&itemId=130503007&issue=OpenSourcePolitics%7Cintern-tasks%7C117

Tasks

• Add specs

📷 Screenshots

BO

FO

[alecslupu]

@Stef-Rousset head's up!

[alecslupu]

Why not use here a "decidim_sanitize_translated", to avoid XSS ?

Suggested change

	[subcategory.weight, translated_attribute(subcategory.name)]
	[subcategory.weight, decidim_sanitize_translated(subcategory.name)]

[alecslupu]

Why not a ?

Suggested change

	Decidim::CheckBoxesTreeHelper::TreePoint.new(subcategory.id.to_s, translated_attribute(subcategory.name))
	Decidim::CheckBoxesTreeHelper::TreePoint.new(subcategory.id.to_s, decidim_sanitize_translated(subcategory.name))

[alecslupu]

Suggested change

	Decidim::CheckBoxesTreeHelper::TreePoint.new(category.id.to_s, translated_attribute(category.name)),
	Decidim::CheckBoxesTreeHelper::TreePoint.new(category.id.to_s, decidim_sanitize_translated(category.name)),

[Stef-Rousset]

Hello @alecslupu , thanks for your review ! I totally understand your concern about the security. I have a little question about this case, and I will appreciate your expertise on it. I tested (in the decidim-app) the categories without escape in front, and the <script >alert('XSS')</script> is not executed in the BO nor in the FO, even in the FO if I filter with it on the proposals index for instance, or I create a new proposal.

Also, the scopes, which are as categories created in the BO, are not sanitized in the BO nor in the FO, and the script <script >alert('XSS scope')</script> is executed in the BO when you arrive on the process show page, and also in the FO when you create a proposal.
<img widt

I would really appreciate your analysis on this topic, thanks and have a nice day !