Security Fix: Potential XSS Vulnerability in stripXss function

[scyt01]

This PR addresses a potential vulnerability in the stripXss() function in XssSqlUtil.java that could lead to Cross-Site Scripting (XSS) attacks because it does not use the ESAPI library for canonicalization which leaves it vulnerable to encoded attacks. This issue was originally reported and resolved in the repository via this commit logicaldoc/community@739b005.

Fix

• Add Canonicalization

  • Use the ESAPI library to canonicalize input before applying regex patterns

• Include Additional Regex Patterns

  • Add regex patterns to handle sequences like ";, ';, ");, and '); to prevent injection attacks that use these sequences to terminate or manipulate scripts

References
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-Site Scripting')
CWE-116: Improper Encoding or Escaping of Output
logicaldoc/community@739b005