Self XSS when deleting event or identity

Description

When deleting an event or an identity, a dialog asks the user to input the event or identity title. In this dialog, the title is processed as raw HTML allowing self-XSS.

Steps to Reproduce

Create event with title: My Event <img src="http://placekitten.com/g/200/300" onclick="alert('aaa')"/>
Click delete
Enjoy kitten image
Click on kitten to trigger JavaScript code

Expected behaviour:

The title should be displayed as as text.

The current code is:

    this.$buefy.dialog.prompt({
      type: 'is-danger',
      title: this.$t('Delete event') as string,
      message: `${prefix}
        ${this.$t('Are you sure you want to delete this event? This action cannot be reverted.')}
        <br><br>
        ${this.$t('To confirm, type your event title "{eventTitle}"', { eventTitle: event.title })}`,
      confirmText: this.$t(
                'Delete {eventTitle}',
                { eventTitle: event.title },
            ) as string,
      inputAttrs: {
        placeholder: event.title,
        pattern: event.title,
      },
      onConfirm: () => this.deleteEvent(event, currentActor),
    });

event.title should be escaped in message.

Actual behaviour:

The title in handled as HTML and tags/javascript can be injected.

Reproduces how often:

100%

Versions

https://test.mobilizon.org/ (2019-0-16)

Additional Information

Currently there is probably the security impact is probably minimal because AFAIU only the owner of the event/identity can see these dialogues.

This could become more problematic if:

shared events are introduced;
this pattern is reused somewhere else.

Admin message