fix: XSS vulnurability in Table HTML cell

app/client/src/widgets/TableWidgetV2/component/cellComponents/HTMLCell/utils.tsx

@@ -12,10 +12,9 @@ export const sendHTMLCellAnalytics = debounce(
 );
 
 export function extractHTMLTags(htmlString: string): string[] {
-  const div = document.createElement("div");
-
-  div.innerHTML = htmlString;
-  const elements = Array.from(div.getElementsByTagName("*"));
+  const parser = new DOMParser();
+  const doc = parser.parseFromString(htmlString, "text/html");
+  const elements = Array.from(doc.body.getElementsByTagName("*"));
   const uniqueTags = new Set(
     elements.map((element) => element.tagName.toLowerCase()),
   );

app/client/src/widgets/TableWidgetV2/widget/derived.js

@@ -297,11 +297,10 @@ export default {
       }
 
       try {
-        const tempDiv = document.createElement("div");
+        const parser = new DOMParser();
+        const doc = parser.parseFromString(html, "text/html");
 
-        tempDiv.innerHTML = html;
-
-        return tempDiv.textContent || tempDiv.innerText || "";
+        return doc.body.textContent || "";
       } catch (e) {
         return "";
       }
@@ -380,9 +379,9 @@ export default {
     const sortByColumnId = props.sortOrder.column;
 
     let sortedTableData;
-    /* 
-    Check if there are select columns, 
-    and if the columns are sorting by label instead of default value 
+    /*
+    Check if there are select columns,
+    and if the columns are sorting by label instead of default value
     */
     const selectColumnKeysWithSortByLabel = [];
 
@@ -397,9 +396,9 @@ export default {
       }
     });
 
-    /* 
-    If there are select columns, 
-    transform the specific columns data to show the label instead of the value for sorting 
+    /*
+    If there are select columns,
+    transform the specific columns data to show the label instead of the value for sorting
     */
     let processedTableDataWithLabelInsteadOfValue;