security: Sanitize disabled RichEditor state (#20029)

Author: danharrin

packages/forms/resources/views/components/rich-editor.blade.php

@@ -9,12 +9,10 @@
 <x-dynamic-component :component="$getFieldWrapperView()" :field="$field">
     @if ($isDisabled)
         <div
-            x-data="{
-                state: $wire.{{ $applyStateBindingModifiers("\$entangle('{$statePath}')") }},
-            }"
-            x-html="state"
             class="fi-fo-rich-editor fi-disabled prose block w-full max-w-none rounded-lg bg-gray-50 px-3 py-3 text-gray-500 shadow-sm ring-1 ring-gray-950/10 dark:prose-invert dark:bg-transparent dark:text-gray-400 dark:ring-white/10 sm:text-sm"
-        ></div>
+        >
+            {!! str($getState())->sanitizeHtml() !!}
+        </div>
     @else
         <x-filament::input.wrapper
             :valid="! $errors->has($statePath)"

tests/src/Forms/Components/RichEditorTest.php

@@ -0,0 +1,37 @@
+<?php
+
+use Filament\Forms\Components\RichEditor;
+use Filament\Forms\Form;
+use Filament\Tests\Forms\Fixtures\Livewire;
+use Filament\Tests\TestCase;
+use Illuminate\Contracts\View\View;
+
+use function Filament\Tests\livewire;
+
+uses(TestCase::class);
+
+it('sanitizes stored HTML when rendering the disabled state to prevent stored XSS', function () {
+    livewire(TestComponentWithDisabledRichEditor::class)
+        ->fillForm([
+            'content' => '<p>Safe paragraph</p><img src=x onerror="window.__xss = true">',
+        ])
+        ->assertDontSeeHtml('onerror="window.__xss = true"');
+});
+
+class TestComponentWithDisabledRichEditor extends Livewire
+{
+    public function form(Form $form): Form
+    {
+        return $form
+            ->schema([
+                RichEditor::make('content')
+                    ->disabled(),
+            ])
+            ->statePath('data');
+    }
+
+    public function render(): View
+    {
+        return view('forms.fixtures.form');
+    }
+}