Enterprise-ng: XSS in dropdown when the input is cleared

[anhallbe]

Describe the bug
Script tags inside dropdown options are executed when removing search text using backspace.

To Reproduce
Given the following component:

<select soho-dropdown [(ngModel)]="selected">
  <option *ngFor="let option of options" [value]="option">{{option}}</option>
</select>

@Component({
  selector: 'app-dropdown-xss',
  templateUrl: './dropdown-xss.component.html',
  styleUrls: ['./dropdown-xss.component.css']
})
export class DropdownXssComponent {
  selected = 'Hello';
  options = [
    {
      label: `<script>window.alert('xss')</script>XSS`,
      value: `<script>window.alert('xss')</script>XSS`,
  ];
}

Steps to reproduce the behavior:

1. Click the dropdown
2. Type a character, e.g "a"
3. Press backspace
4. The script executes, and an alert window is opened.

Expected behavior
The script should not execute.

Version

• ids-enterprise-ng: 6.1.0
• ids-enterprise: 4.22.0

Platform
Tested in Chrome & Firefox on Windows.

Additional context
Related: https://github.com/infor-design/enterprise-ng/issues/503

I can reproduce it on the current master branch of the enterprise-ng project by making the following changes:

1. Remove noSearch from the line with <select soho-dropdown in dropdown-simple.html

[janahintal]

QA Failed.

Unable to select values with double quotes "

1. Goto http://master-enterprise.demo.design.infor.com/components/dropdown/test-special-chars.html
2. Using arrow key, select "Value Contains escaped "quote" " or "it has "dbl quotes" "

Icon color is distorted in responsive view

1. Go to http://master-enterprise.demo.design.infor.com/components/dropdown/example-icons.html?theme=soho&variant=light&colors=941e1e
2. Minimize the screen
3. Open the Dropdown with Colors
   

[brianjuan]

Additionally, in http://master-enterprise.demo.design.infor.com/components/dropdown/test-xss.html, searching some characters returns results that are not part of the list.

1. Type "(" or ")", the result will return "$1"
   
2. Type "x", the result will return "\'"
   
3. In the 2nd dropdown, type "t", the result will return "\""
   

[brianjuan]

All the issues found above are now fixed across all browsers except for the selecting of "Value Contains escaped "quote"" and "it has "dbl quotes"" using Enter key in http://4230-beta0-enterprise.demo.design.infor.com/components/dropdown/test-special-chars.html.
Steps:

1. Open dropdown then type "
2. Press arrow down key then select "Value Contains escaped "quote"" by pressing Enter key
3. See issue: it won't be selected.

Should we make separate ticket/issue for that @tmcconechy ?

[tmcconechy]

I think this is fine as failed QA as that case isnt working.

[CindyMercadoReyes]

This issue is now resolved. Moving this to Done bucket.